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BlackBerry UEM Architecture and data flows 


The BlackBerry UEM architecture was designed to help you manage mobile devices for your organization and 
provide a secure link for data to travel between your organization's mail and content servers and your user's 
devices. 


Architecture: BlackBerry UEM solution 
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Component Description 
BlackBerry UEM BlackBerry UEM is a unified endpoint management solution that provides 


comprehensive multiplatform device, application, and content management with 
integrated security and connectivity. 


BlackBerry Infrastructure The BlackBerry Infrastructure registers user information for device activation, 
validates licensing information for BlackBerry UEM, and provides a trusted path 
between the organization and every user based on strong, cryptographic, mutual 
authentication. 


BlackBerry UEM maintains a constant connection to the BlackBerry Infrastructure, 
meaning that organizations require only a single outbound connection to a trusted 
IP address to send data to users. All the data that travels between the BlackBerry 
Infrastructure and BlackBerry UEM is authenticated and encrypted to provide a 
secure communication channel into your organization for devices outside the 


firewall. 
BlackBerry The BlackBerry Dynamics NOC is a network operations center that provides secure 
Dynamics NOC communications between BlackBerry Dynamics apps on devices and BlackBerry 


UEM and the BlackBerry Enterprise Mobility Server. 


| BlackBerry UEM Architecture and data flows | 5 


Component 


Description 





Devices 


Notification services 


Routing components 


Third-party application 
and content servers 


BEMS and BlackBerry plug- 
ins 


BlackBerry UEM supports BlackBerry 10, iOS, macOS, Android, Windows, 
and BlackBerry OS (version 5.0 to 7.1) devices. 


BlackBerry UEM sends notifications to devices to contact BlackBerry UEM for 
updates and to report information for your organization’s device inventory. These 
notifications are sent to the BlackBerry Infrastructure, where they are sent to the 
devices using the appropriate notification service: 


- APNsis a service that Apple provides to send notifications 
to iOS and macOS devices. 
GCM is a service that Google provides to send notifications 
to Android devices. 
Windows Push Notification Services (WNS) is a service that Microsoft provides 
to send notifications to Windows devices. 





By default, BlackBerry UEM makes a direct connection to the BlackBerry 
Infrastructure over ports 3101 and 443, and you do not need to install more 
routing components. However, if your organization's security policy requires that 
internal systems cannot make connections directly to the Internet, you can use 
the BlackBerry Router or a proxy server. 


The BlackBerry Router acts as a proxy server for connections over the BlackBerry 
Infrastructure between BlackBerry UEM and all devices. The BlackBerry Router can 
support SOCKs v5 with no authentication. 


If your organization already has a TCP proxy server installed or requires one 
to meet networking requirements, you can use a TCP proxy server instead of 
the BlackBerry Router. The TCP proxy server can support SOCKs v5 with no 
authentication. 


The BlackBerry UEM Core and BlackBerry Proxy support using an HTTP proxy 
server to connect to the BlackBerry Dynamics NOC. 


Additional content servers and application servers in your organization's 
environment, including the company directory, mail server, certificate authorities, 
and so on. 


BlackBerry UEM works with additional BlackBerry enterprise products such 
as: BlackBerry Enterprise Identity, BlackBerry 2FA, BlackBerry Workspaces, 
and BlackBerry WorkLife, to allow you to extend UEM capabilities in your 
organization. 


The BlackBerry Enterprise Mobility Server provides several services used to send 
work data to and from BlackBerry Dynamics apps. 
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BlackBerry UEM components 


This diagram shows how the BlackBerry UEM components connect when all components are installed together in 
the product's simplest configuration. 
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For information about the ports used for connections between components, see "Configuring ports" in the 
Installation and upgrade content. 


| Component name Description | 


BlackBerry UEM Core The BlackBerry UEM Core is the central component of the BlackBerry 
UEM architecture. It consists of several subcomponents that are responsible for: 








+ Logging, monitoring, reporting, and management functions 

* Authentication and authorization services 

* Scheduling and sending commands, IT policies, and profiles to devices 

* Sending user, policy, and other configuration data to BlackBerry Dynamics apps 


on devices. 
BlackBerry The BlackBerry UEM database is a relational database that contains user account 
UEM database information and configuration information that BlackBerry UEM uses to manage 


devices and BlackBerry Dynamics apps. 
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Component name 


Description 





BlackBerry MDS 
Connection Service 


BlackBerry Dispatcher 


BlackBerry Affinity 
Manager 


BlackBerry Proxy 


BlackBerry Secure 
Connect Plus 


BlackBerry Secure 
Gateway 


BlackBerry Gatekeeping 
Service 


Management console 
and BlackBerry UEM Self- 
Service 


BlackBerry Enterprise 
Mobility Server 


BlackBerry 
Enterprise Mobility 
Server databases 


BlackBerry Push 
Notifications 


The BlackBerry MDS Connection Service provides a secure connection 
between BlackBerry 10 devices and your organization's network when the device is 
not connected to your work Wi-Fi network or using a VPN connection. 


The BlackBerry Dispatcher provides secure connectivity using IPPP for BlackBerry 
10 devices. 


The BlackBerry Affinity Manager is responsible for maintaining an active SRP 
connection between BlackBerry 10 devices and the BlackBerry Infrastructure when 
the devices are not using BlackBerry Secure Connect Plus. 


BlackBerry Proxy maintains the secure connection between your organization 
and the BlackBerry Dynamics NOC. It also supports BlackBerry Dynamics Direct 
Connect, which allows app data to bypass the BlackBerry Dynamics NOC. 


BlackBerry Secure Connect Plus provides a secure IP tunnel between work apps 
on devices and your organization's network. One tunnel that supports standard 
IPv4 (TCP and UDP) data is established for each device through the BlackBerry 
Infrastructure. 


The BlackBerry Secure Gateway provides a secure connection through 
the BlackBerry Infrastructure and BlackBerry UEM to your organization's mail 
server for iOS devices. 


The BlackBerry Gatekeeping Service sends commands to Exchange ActiveSync to 
add devices to an allowed list when devices are activated on BlackBerry UEM. 
Unmanaged devices that try to connect to an organization's mail server can be 
reviewed, verified, and blocked or allowed by an administrator using the BlackBerry 
UEM management console. 


The management console and BlackBerry UEM Self-Service provide a web-based 
user interface for administrator and user access to BlackBerry UEM. 


You use the management console to manage system settings, users, devices, and 
apps. 


Users can use BlackBerry UEM Self-Service to set an activation password and 
send commands to devices, such as set password, lock device, and delete device 
data. 


BEMS consolidates several services used to send work data to 
and from BlackBerry Dynamics apps, including: BlackBerry Push 
Notifications, BlackBerry Connect, BlackBerry Presence, and BlackBerry Docs. 


The BEMS databases store user, app, policy, and configuration information. 


BlackBerry Push Notifications accepts push registration requests 
from iOS and Android devices and then communicates with Microsoft Exchange to 
monitor the user's work mail account for changes. 
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Component name Description 





BlackBerry Connect BlackBerry Connect provides secure instant messaging, company directory look- 
up, and user presence information to iOS and Android devices. 


BlackBerry Presence BlackBerry Presence provides real-time presence status to BlackBerry 
Dynamics apps. 


BlackBerry Docs BlackBerry Docs lets your BlackBerry Dynamics app users access, synchronize, 
and share documents using their work file server, SharePoint, Box, and content 
management systems supporting CMIS, without the need for VPN software, 
firewall reconfiguration, or duplicate data stores. 


BlackBerry Router and/or By default, BlackBerry UEM makes a direct connection to the BlackBerry 

proxy servers Infrastructure over ports 3101 and 443. If your organization's security policy 
requires that internal systems not connect directly to the Internet, you can install 
the BlackBerry Router or use a third-party TCP proxy server that supports SOCKs 
v5 with no authentication. 


The BlackBerry UEM Core and BlackBerry Proxy support using a third-party HTTP 
proxy server to connect to the BlackBerry Dynamics NOC. 


BlackBerry The BlackBerry Infrastructure registers user information for device activation, 

Infrastructure and BlackBei validates licensing information for BlackBerry UEM and provides a trusted path 

Dynamics NOC between the organization and every user based on strong, cryptographic, mutual 
authentication. 


The BlackBerry Dynamics NOC is a separately-located NOC that provides 
secure communications between BlackBerry Dynamics apps on devices and 
the BlackBerry UEM Core, BlackBerry Proxy, and BlackBerry Enterprise Mobility 
Server. 
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BlackBerry UEM distributed installation 


This diagram shows how the BlackBerry UEM components connect together when the BlackBerry Connectivity 
Node and the user interface are both installed separately from the primary BlackBerry UEM components. 
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For information about the ports used for connections between components, see "Configuring ports" in the 
Installation and upgrade content. 


| Component name Description | 








Primary BlackBerry The primary BlackBerry UEM components include the BlackBerry UEM Core and all 
UEM components components installed with it on the same server. 
BlackBerry UEM Core The BlackBerry UEM Core is the central component of the BlackBerry 


UEM architecture. It consists of several subcomponents that are responsible for: 


+ Logging, monitoring, reporting, and management functions 
* Authentication and authorization services 
* Scheduling and sending commands, IT policies, and profiles to devices 


+ Sending user, policy, and other configuration data to BlackBerry Dynamics apps 
on devices. 
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Component name 


Description 





BlackBerry 
UEM database 


BlackBerry MDS 
Connection Service 


BlackBerry Collaboration 
Service 


BlackBerry Dispatcher 


BlackBerry Affinity 
Manager 


BlackBerry Gatekeeping 
Service (primary) 


Management console 
and BlackBerry UEM Self- 
Service 


BlackBerry Connectivity 
Node 


BlackBerry Cloud 
Connector 


The BlackBerry UEM database is a relational database that contains user account 
information and configuration information that BlackBerry UEM uses to manage 
devices and BlackBerry Dynamics apps. 


The BlackBerry MDS Connection Service provides a secure connection 
between BlackBerry 10 devices and your organization's network when the device is 
not connected to your work Wi-Fi network or using a VPN connection. 


The BlackBerry Collaboration Service provides an encrypted connection 
between your organization's instant messaging server and the Enterprise IM app 
on BlackBerry 10 devices. 


The BlackBerry Dispatcher provides secure connectivity using IPPP for BlackBerry 
10 devices. 


The BlackBerry Affinity Manager is responsible for maintaining an active SRP 
connection between BlackBerry 10 devices and the BlackBerry Infrastructure when 
the devices are not using BlackBerry Secure Connect Plus. 


The BlackBerry Gatekeeping Service sends commands to Exchange ActiveSync to 
add devices to an allowed list when devices are activated on BlackBerry 

UEM. Unmanaged devices that try to connect to an organization's mail server 

can be reviewed, verified, and blocked or allowed through the BlackBerry 

UEM management console by an administrator. 


The management console and BlackBerry UEM Self-Service provide a web-based 
user interface for administrator and user access to BlackBerry UEM. It can be 
installed separately from other BlackBerry UEM components. 


You use the management console to manage system settings, users, devices, and 
apps. 
Users can access BlackBerry UEM Self-Service to set an activation password and 


send commands, such as set password, lock device, and delete device data, to 
devices. 


The BlackBerry Connectivity Node installs instances of the BlackBerry UEM device 
connectivity components to your organization’s domain on a different server than 
the BlackBerry UEM Core. Each BlackBerry Connectivity Node contains these 
components: 


* BlackBerry Cloud Connector 

+ BlackBerry Proxy 

+ BlackBerry Secure Connect Plus 
* BlackBerry Secure Gateway 

+ BlackBerry Gatekeeping Service 


The BlackBerry Cloud Connector allows the BlackBerry Connectivity 

Node components to communicate with the BlackBerry UEM Core. All 
communication between the BlackBerry Cloud Connector and BlackBerry UEM 
Core travels through the BlackBerry Infrastructure. 





| BlackBerry UEM distributed installation | 11 


Component name 


Description 





BlackBerry Proxy 


BlackBerry Secure 
Connect Plus 


BlackBerry Secure 
Gateway 


BlackBerry Gatekeeping 
Service (BlackBerry 
Connectivity Node) 


BlackBerry Enterprise 
Mobility Server 


BlackBerry 
Enterprise Mobility 
Server databases 


BlackBerry 


Infrastructure and BlackBe! 


Dynamics NOC 


BlackBerry Proxy maintains the secure connection between your organization 
and the BlackBerry Dynamics NOC. It also supports BlackBerry Dynamics Direct 
Connect, which allows app data to bypass the BlackBerry Dynamics NOC. 


BlackBerry Secure Connect Plus provides a secure IP tunnel between work apps 
on devices and your organization's network. One tunnel that supports standard 
IPv4 (TCP and UDP) data is established for each device through the BlackBerry 
Infrastructure. 


The BlackBerry Secure Gateway provides a secure connection through 
the BlackBerry Infrastructure and BlackBerry UEM to your organization's mail 
server for iOS devices. 


BlackBerry UEM can use instances of BlackBerry Gatekeeping Service that are 
installed with the BlackBerry Connectivity Node to manage gatekeeping for your 
mail server. Each instance must be able to access your organization's gatekeeping 
server. 


If you want gatekeeping data to be managed only by the BlackBerry Gatekeeping 
Service that is installed with the primary BlackBerry UEM components, you can 
disable the BlackBerry Gatekeeping Service in each BlackBerry Connectivity Node 


BEMS consolidates several services used to send work data to 
and from BlackBerry Dynamics apps, including: BlackBerry Push 
Notifications, BlackBerry Connect, BlackBerry Presence, and BlackBerry Docs. 


The BEMS databases store user, app, policy, and configuration information. 


The BlackBerry Infrastructure registers user information for device activation, 
validates licensing information for BlackBerry UEM and provides a trusted path 
between the organization and every user based on strong, cryptographic, mutual 
authentication. 


The BlackBerry Dynamics NOC is a separately-located NOC that provides 
secure communications between BlackBerry Dynamics apps on devices and 
the BlackBerry UEM Core, BlackBerry Proxy , and BlackBerry Enterprise Mobility 
Server. 
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BlackBerry UEM regional deployment 


This diagram shows how the BlackBerry UEM components connect together when one or more instances of 
the BlackBerry Connectivity Node are installed in a separate location. You can use server groups to specify the 
regional instance of the BlackBerry Connectivity Node that a device connects to. 
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For information about the ports used for connections between components, see "Configuring ports" in the 
Installation and upgrade content. 











Component name Description 
Primary BlackBerry The primary BlackBerry UEM components include the BlackBerry UEM Core and all 
UEM components components installed with it on the same server. 
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Component name 


Description 





BlackBerry UEM Core 


BlackBerry 
UEM database 


BlackBerry MDS 
Connection Service 


BlackBerry Dispatcher 


BlackBerry Affinity 
Manager 


BlackBerry Gatekeeping 
Service (primary) 


Management console 
and BlackBerry UEM Self- 
Service 


The BlackBerry UEM Core is the central component of the BlackBerry 
UEM architecture. It consists of several subcomponents that are responsible for: 


+ Logging, monitoring, reporting, and management functions 
* Authentication and authorization services 
* Scheduling and sending commands, IT policies, and profiles to devices 


+ Sending user, policy, and other configuration data to BlackBerry Dynamics apps 
on devices. 


The BlackBerry UEM database is a relational database that contains user account 
information and configuration information that BlackBerry UEM uses to manage 
devices and BlackBerry Dynamics apps. 


The BlackBerry MDS Connection Service provides a secure connection 
between BlackBerry 10 devices and your organization's network when the device is 
not connected to your work Wi-Fi network or using a VPN connection. 


The BlackBerry Dispatcher provides secure connectivity using IPPP for BlackBerry 
10 devices. 


The BlackBerry Affinity Manager is responsible for maintaining an active SRP 
connection between BlackBerry 10 devices and the BlackBerry Infrastructure when 
the devices are not using BlackBerry Secure Connect Plus. 


The BlackBerry Gatekeeping Service sends commands to Exchange ActiveSync to 
add devices to an allowed list when devices are activated on BlackBerry 

UEM. Unmanaged devices that try to connect to an organization's mail server 

can be reviewed, verified, and blocked or allowed through the BlackBerry 

UEM management console by an administrator. 


The Management console and BlackBerry UEM Self-Service provide a web-based 
user interface for administrator and user access to BlackBerry UEM. It can be 
installed separately from other BlackBerry UEM components. 


You use the management console to manage system settings, users, devices, and 
apps. 
Users can access BlackBerry UEM Self-Service to set an activation password and 


send commands, such as set password, lock device, and delete device data, to 
devices. 
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Component name 


Description 





BlackBerry Connectivity 
Node 


BlackBerry Cloud 
Connector 


BlackBerry Proxy 


BlackBerry Secure 
Connect Plus 


BlackBerry Secure 
Gateway 


BlackBerry Gatekeeping 
Service (BlackBerry 
Connectivity Node) 


BlackBerry Enterprise 
Mobility Server 


BlackBerry 
Enterprise Mobility 
Server databases 


The BlackBerry Connectivity Node installs instances of the BlackBerry UEM device 
connectivity components to your organization’s domain on a different server than 
the BlackBerry UEM Core. Each BlackBerry Connectivity Node contains these 
components: 


BlackBerry Cloud Connector 
BlackBerry Proxy 

BlackBerry Secure Connect Plus 
BlackBerry Secure Gateway 
BlackBerry Gatekeeping Service 


If you have regional deployments of the BlackBerry Connectivity Node you must 
configure the connection between the BlackBerry UEM Core and the server group 
containing the regional BlackBerry Connectivity Node. 


The BlackBerry Cloud Connector allows the BlackBerry Connectivity 

Node components to communicate with the BlackBerry UEM Core. All 
communication between the BlackBerry Cloud Connector and BlackBerry UEM 
Core travels through the BlackBerry Infrastructure. 


BlackBerry Proxy maintains the secure connection between your organization 
and the BlackBerry Dynamics NOC. It also supports BlackBerry Dynamics Direct 
Connect, which allows app data to bypass the BlackBerry Dynamics NOC. 


BlackBerry Secure Connect Plus provides a secure IP tunnel between work apps 
on devices and your organization's network. One tunnel that supports standard 
IPv4 (TCP and UDP) data is established for each device through the BlackBerry 
Infrastructure. 


The BlackBerry Secure Gateway provides a secure connection through 
the BlackBerry Infrastructure and BlackBerry UEM to your organization's mail 
server for iOS devices. 


BlackBerry UEM can use instances of BlackBerry Gatekeeping Service installed 
with the BlackBerry Connectivity Node to manage gatekeeping for your mail 
server. Each instance must be able to access your organization’s gatekeeping 
server. 


If you want gatekeeping data to be managed only by the BlackBerry Gatekeeping 
Service that is installed with the primary BlackBerry UEM components, you can 
disable the BlackBerry Gatekeeping Service in each BlackBerry Connectivity Node 


BEMS consolidates several services used to send work data to 
and from BlackBerry Dynamics apps, including: BlackBerry Push 
Notifications, BlackBerry Connect, BlackBerry Presence, and BlackBerry Docs. 


The BEMS databases store user, app, policy, and configuration information. 
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Component name Description 





BlackBerry The BlackBerry Infrastructure registers user information for device activation, 
Infrastructure and BlackBerryalidates licensing information for BlackBerry UEM and provides a trusted path 
Dynamics NOC between the organization and every user based on strong, cryptographic, mutual 


authentication. 


The BlackBerry Dynamics NOC is a separately-located NOC that provides 
secure communications between BlackBerry Dynamics apps on devices and 
the BlackBerry UEM Core, BlackBerry Proxy and BlackBerry Enterprise Mobility 
Server. 
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Components used to manage BlackBerry OS devices 


Some BlackBerry UEM components are used only for managing BlackBerry OS (versions 5.0 to 7.1) devices. This 
diagram shows the BlackBerry UEM components used for managing BlackBerry OS devices. 
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| Component name Description | 


BlackBerry UEM Core The BlackBerry UEM Core is the central component of BlackBerry 
UEM architecture and consists of several subcomponents that are responsible 
for: 
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+ Logging, monitoring, reporting, and management functions 

+ Authentication and authorization services for the BlackBerry UEM Core local 
directory and company directories 

* Scheduling and sending commands, IT policies, and profiles to devices 


If there are multiple BlackBerry UEM instances in the domain, all the BlackBerry 
UEM Core instances are active and each of them can connect to the BlackBerry 
Infrastructure and processes traffic. After you install BlackBerry UEM ona 
computer, you can install the BlackBerry UEM Core on another computer. 


BlackBerry UEM database The BlackBerry UEM database is a relational database that contains user account 
information and configuration information that BlackBerry UEM uses to manage 
devices. You can install the BlackBerry UEM database on the same computer 
as a BlackBerry UEM instance, or on a separate computer. For redundancy or 
business continuity, you can configure database mirroring. 
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Component name 





Description 





BlackBerry Administration 
Service 


BlackBerry Attachment 
Service 


BlackBerry Collaboration 


Service for BlackBerry OS 


BlackBerry Controller 


BlackBerry 


Dispatcher for BlackBerry OS, 


BlackBerry Mail Store 
Service 


BlackBerry MDS 
Connection 
Service for BlackBerry OS 


BlackBerry Messaging 
Agent 


You can use the BlackBerry Administration Service to configure BlackBerry OS 
device software updates, and VPN and Wi-Fi profiles for BlackBerry OS (versions 
5.0 to 7.1) devices. 


The BlackBerry Administration Service connects to the BlackBerry UEM database. 
It also provides connection services for the management console so that you can 
manage BlackBerry OS devices. 


The BlackBerry Attachment Service converts supported attachments into a 
format that can be viewed on BlackBerry OS devices. The BlackBerry Attachment 
Service converts attachments for the BlackBerry Messaging Agent, the BlackBerry 
MDS Connection Service for BlackBerry OS, and the BlackBerry Collaboration 
Service. 


The BlackBerry Collaboration Service for BlackBerry OS is an optional component 
that provides a connection between your organization's instant messaging server 
and the collaboration client on BlackBerry OS devices. 


The BlackBerry Controller monitors components used to manage BlackBerry OS 
devices and restarts these components when they stop responding. 


The BlackBerry Dispatcher for BlackBerry OS performs the following functions: 


Transfers data between components used to manage BlackBerry OS devices 

* Compresses and encrypts data that is sent to BlackBerry OS devices 

- Decrypts and decompresses data that is received from BlackBerry OS devices 

+ Monitors and communicates the health of BlackBerry OS management 
components 

+ Starts the processing of BlackBerry OS device users on the BlackBerry 

Messaging Agent 


The BlackBerry Mail Store Service connects to the mail servers in your 
organization's environment and retrieves the contact information that 

the BlackBerry Administration Service requires to search for user accounts on the 
mail servers. 


The BlackBerry MDS Connection Service for BlackBerry OS permits applications 
on BlackBerry OS devices to connect to your organization's application or content 
servers for application data and updates. 


The BlackBerry Messaging Agent performs the following functions: 


* Connects to the mail server to provide messaging services, calendar 
management, contact lookups, attachment viewing, and attachment retrieval 
for BlackBerry OS devices 

* Allows the BlackBerry Synchronization Service to access organizer data on the 
mail server 

+ Synchronizes configuration data between the BlackBerry UEM database 
and BlackBerry OS device user mailboxes on the mail server 
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Component name Description 





BlackBerry Policy Service |The BlackBerry Policy Service performs administration services for BlackBerry OS 
devices over the wireless network, such as sending IT policies, device commands, 
and service books. 


BlackBerry Router The BlackBerry Router acts as a proxy server for connections over the BlackBerry 
Infrastructure between BlackBerry UEM and all devices. For BlackBerry OS 
(version 5.0 to 7.1) devices, the BlackBerry Router also sends data directly to and 
receives data from devices that are connected to a work Wi-Fi network or to a 
computer that has the BlackBerry Device Manager. 


If you upgrade from BES5 version 5.0.4 MR10 to BlackBerry UEM, the BlackBerry 
Router you originally installed with your BES5 continues to work only for the 
components used to manage BlackBerry OS devices. If you install a new instance 
of the BlackBerry Router with BlackBerry UEM, you can configure it to work with all 
components 


If you use an existing TCP proxy server instead of the BlackBerry 

Router, BlackBerry OS devices that are connected to a work Wi-Fi network or 
to a computer that has BlackBerry Device Manager installed cannot bypass 
the BlackBerry Infrastructure to connect to your organization's network. 


BlackBerry The BlackBerry Synchronization Service synchronizes organizer data 
Synchronization Service between BlackBerry OS devices and your organization's mail server using 
the BlackBerry Messaging Agent. The BlackBerry Synchronization Service also 
synchronizes BlackBerry OS device user data with the BlackBerry UEM database. 


BlackBerry Web Desktop BlackBerry OS device users can access BlackBerry Web Desktop Manager to 
Manager set an activation password, activate their devices by connecting them 
to the computer, and perform other device management functions for 
their BlackBerry OS devices, such as updating the device software or sending 
device commands. 


Management console The management console is a web-based console that is used to: 


* Complete postinstallation configuration settings 

+ View and manage users, devices, policies, profiles, and apps 

+ View and manage system settings, including customizing the activation email 
message and adding an APNs certificate 

* Move IT policies, profiles, groups, and users to BlackBerry UEM 


The management console also provides access to BlackBerry UEM Self- 

Service and allows iOS device users to manage apps using the Work Apps icon. 
After you install BlackBerry UEM on a computer, you can install the management 
console on another computer. 
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Activating devices 


Depending on the device type and the activation type that you specify for it, the device and BlackBerry UEM must 
complete several steps during the activation process to authenticate to each other, secure a communication 
channel and, if needed, create a work space or encrypt the device before any configuration and work data is sent 
to the device. For instructions to activate devices, see "Device activation" in the Administration content. 


Device activation types give you different degrees of control over the work and personal data on devices, ranging 
from full control over all data to specific control over work data only. For more information about activation 
types, see "Creating activation profiles" in the Administration content. 


Data flow: Activating a BlackBerry 10 device 





BlackBerry UEM 8 
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UEM Self-Service computer 


1. You perform the following actions: 


a. Add a user to BlackBerry UEM as a local user account or using the account information retrieved from your 
company directory 


b. Assign an activation profile to the user 
c. Use one of the following options to provide the user with activation details: 


+ Automatically generate a device activation password and send an email with activation instructions for 
the user 


* Seta device activation password and communicate the username and password to the user directly or 
by email 
* Don't set a device activation password and communicate the BlackBerry UEM Self-Service address to 
the user so that they can set their own activation password 
2. The user performs the following actions: 


a. Types the username and activation password on the device 


b. Fora "Work and personal - Regulated" or "Work space only" activation, accepts the organization notice, 
which outlines the terms and conditions that the user must agree to 


3. If the activation is a "Work space only" activation, the device deletes all existing data and restarts. For other 
activation types, the Enterprise Management Agent on the device performs the following actions: 


a. Establishes a connection to the BlackBerry Infrastructure 
b. Sends a request for activation information to the BlackBerry Infrastructure 
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4. The BlackBerry Infrastructure performs the following actions: 


a. Verifies that the user is a valid, registered user 

b. Retrieves the BlackBerry UEM address for the user 

c. Sends the address to the Enterprise Management Agent 
5. The device performs the following actions: 


a. Establishes a connection with BlackBerry UEM 

b. Generates a shared symmetric key that is used to protect the CSR and response BlackBerry UEM using the 
activation password and EC-SPEKE. 

c. Creates an encrypted CSR and HMAC as follows: 


Generates a key pair for the certificate 
Creates a PKCS#10 CSR that includes the public key of the key pair 
Encrypts the CSR using the shared symmetric key and AES-256 in CBC mode with PKCS#5 padding 
Computes an HMAC of the encrypted CSR using SHA-256 and appends it to the CSR 
d. Sends the encrypted CSR and HMAC to BlackBerry UEM 
6. BlackBerry UEM performs the following actions: 


. Verifies the HMAC of the encrypted CSR and decrypts the CSR using the shared symmetric key 

. Retrieves the username, work space ID, and your organization’s name from the BlackBerry UEM database 
. Packages a client certificate using the information it retrieved and the CSR that the device sent 

. Signs the client certificate using the enterprise management root certificate 


. Encrypts the client certificate, enterprise management root certificate, and the BlackBerry UEM URL using 
the shared symmetric key and AES-256 in CBC mode with PKCS#5 padding 


Computes an HMAC of the encrypted client certificate, enterprise management root certificate, and 
the BlackBerry UEM URL and appends it to the encrypted data 

g. Sends the encrypted data and HMAC to the device 
7. The device performs the following actions: 


a. Verifies the HMAC 

b. Decrypts the data it received from BlackBerry UEM 

c. Stores the client certificate and the enterprise management root certificate in its keystore 
8. BlackBerry UEM performs the following actions: 
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a. BlackBerry UEM Core assigns the new device to a BlackBerry UEM instance in the domain 
b. BlackBerry UEM Core notifies the active BlackBerry Affinity Manager that a new device is assigned to 
the BlackBerry UEM instance 
c. The active BlackBerry Affinity Manager notifies the BlackBerry Dispatcher on that BlackBerry UEM instance 
that there is a new device 
d. The BlackBerry UEM Core sends configuration information, including enterprise connectivity settings to the 
device 
9. BlackBerry UEM Core and the device generate the device transport key using ECMQV and the authenticated 
long-term public keys from the client certificate and the server certificate for BlackBerry UEM. This key is used 
to encrypt work data when not using BlackBerry Secure Connect Plus and push to IPPP data. 
10.The device sends an acknowledgment over TLS to BlackBerry UEM to confirm that it received and applied the 
IT policy and other data and created the work space. The activation process is complete. 


The elliptic curve protocols used during the activation process use the NIST-recommended 521-bit curve. 
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Data flow: Activating an Android device for MDM 
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1. You perform the following actions: 


Administrator’s _ 
computer 7 __! Optional components 


a. Add a user to BlackBerry UEM as a local user account or using the account information retrieved from your 
company directory 

b. Make sure an activation profile that specifies the "MDM controls" activation type is assigned to the user 

c. Use one of the following options to provide the user with activation details: 


* Automatically generate a device activation password and, optionally, a QR Code and send an email with 
activation instructions for the user 
* Seta device activation password and communicate the username and password to the user directly or 
by email 
* Don't set a device activation password and communicate the BlackBerry UEM Self-Service address to 
the user so that they can set their own activation password and view a QR Code. 
2. The user downloads and installs the BlackBerry UEM Client on the device. After it is installed, the user opens 
the BlackBerry UEM Client and enters the email address and activation password or scans the QR Code. 
3. The BlackBerry UEM Client on the device performs the following actions: 


a. Establishes a connection to the BlackBerry Infrastructure 
b. Sends a request for activation information to the BlackBerry Infrastructure 
4. The BlackBerry Infrastructure performs the following actions: 


a. Verifies that the user is a valid, registered user 
b. Retrieves the BlackBerry UEM address for the user 
c. Sends the address to the BlackBerry UEM Client 


5. The BlackBerry UEM Client establishes a connection with BlackBerry UEM using an HTTP CONNECT call over 
port 443 and sends an activation request to BlackBerry UEM. The activation request includes the username, 
password, device operating system, and unique device identifier. 

6. BlackBerry UEM performs following actions: 


a. Inspects the credentials for validity 

. Creates a device instance 

Associates the device instance with the specified user account in the BlackBerry UEM database 
. Adds the enrollment session ID to an HTTP session 

Sends a successful authentication message to the device 


o20c 
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7. The BlackBerry UEM Client creates a CSR using the information received from BlackBerry UEM and sends a 
client certificate request to BlackBerry UEM over HTTPS. 


8. BlackBerry UEM performs the following actions: 


a. Validates the client certificate request against the enrollment session ID in the HTTP session 
b. Signs the client certificate request with the root certificate 
c. Sends the signed client certificate and root certificate back to the BlackBerry UEM Client 


A mutually authenticated TLS session is established between the BlackBerry UEM Client and BlackBerry UEM. 

9. The BlackBerry UEM Client requests all configuration information and sends the device and software 
information to BlackBerry UEM. 

10.BlackBerry UEM stores the device information in the database and sends the requested configuration 
information to the device. 

11.The BlackBerry UEM Client determines if the device uses KNOX MDM and is running a supported MDM 
version. If the device uses KNOX MDM, the device connects to the Samsung infrastructure and activates 
the KNOX management license. After it is activated, the BlackBerry UEM Client applies the KNOX MDM IT 
policy rules from BlackBerry UEM. 

12.The device sends an acknowledgment to BlackBerry UEM that it received and applied the configuration 
information. The activation process is complete. 
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Data flow: Activating an Android Enterprise device in a Google domain 
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This data flow applies when BlackBerry UEM is connected to a Google Cloud or G Suite domain. For more 
information see the Configuration content. 


1. You perform the following actions: 


a. Verify that the user has a Google account that is associated with the user’s work email address. Optionally, 
you can configure BlackBerry UEM to create the Google account for the user during the activation process. 
When BlackBerry UEM creates the account for the user in Google, the user receives an email from 
the Google domain with their Google account password. 

b. Add a user to BlackBerry UEM as a local user account or using the account information retrieved from your 
company directory. When you specify the email address, use the email address that is associated with the 
user's Google account. 


c. Make sure the "Work and personal - user privacy” or the "Work and personal - user privacy (Premium)” 
activation type is assigned to the user. 


d. Use one of the following options to provide the user with activation details: 


+ Automatically generate a device activation password and, optionally, a QR Code and send an email with 
activation instructions for the user 


* Seta device activation password and communicate the username and password to the user directly or 
by email 
+ Don't set a device activation password and communicate the BlackBerry UEM Self-Service address to 
the user so that they can set their own activation password and view a QR Code. 
2. The user downloads BlackBerry UEM Client from Google Play and installs it on the device. After it is installed, 
the user opens the BlackBerry UEM Client and enters their email address and activation password or scans 
the QR Code. 


3. The BlackBerry UEM Client on the device performs the following actions: 


a. Establishes a connection to the BlackBerry Infrastructure 
b. Sends a request for activation information to the BlackBerry Infrastructure 
4. The BlackBerry Infrastructure performs the following actions: 


a. Verifies that the user is a valid, registered user 
b. Retrieves the BlackBerry UEM address for the user 
c. Sends the address to the BlackBerry UEM Client 

5. The BlackBerry UEM Client establishes a connection with BlackBerry UEM using an HTTP CONNECT call over 
port 443 and sends an activation request to BlackBerry UEM. The activation request includes the username, 
password, device operating system, and unique device identifier. 


6. BlackBerry UEM performs the following actions: 
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Determines the activation type assigned to the user account 

. Connects to the managed Google domain to verify the user information 
Creates a device instance 

. Associates the device instance with the specified user account 

Adds the enrollment session ID to an HTTP session 

. Sends a successful authentication message to the device 

7. If the device is not encrypted, the user is prompted to encrypt the device. 
8. The BlackBerry UEM Client performs the following actions: 
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a. Prompts the user for the user's Google account information 
b. Connects to the managed Google domain to authenticate the user 


c. Creates a CSR using the information received from BlackBerry UEM and sends a client certificate request 
to BlackBerry UEM over HTTPS. 
9. BlackBerry UEM performs the following actions: 


a. Validates the client certificate request against the enrollment session ID in the HTTP session 
b. Signs the client certificate request with the root certificate 
c. Sends the signed client certificate and root certificate back to the BlackBerry UEM Client 


A mutually authenticated TLS session is established between the BlackBerry UEM Client and BlackBerry UEM. 

10.The BlackBerry UEM Client requests all configuration information and sends the device and software 
information to BlackBerry UEM. 

11.BlackBerry UEM stores the device information and sends the requested configuration information to the 
device. 

12.The device sends an acknowledgment to BlackBerry UEM that it received and applied the configuration 
information. The activation process is complete. 


Data flow: Activating an Android Enterprise device using a 
managed Google Play account 
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This data flow applies when you allow BlackBerry UEM to manage Google Play accounts. For more information 
see the Configuration content. 


1. You perform the following actions: 


a. Add a user to BlackBerry UEM as a local user account or using the account information retrieved from your 
company directory. 
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b. Make sure the "Work and personal - user privacy” or the "Work and personal - user privacy (Premium)” 
activation type is assigned to the user. 
c. Use one of the following options to provide the user with activation details: 


+ Automatically generate a device activation password and, optionally, a QR Code and send an email with 
activation instructions for the user 

* Set a device activation password and communicate the username and password to the user directly or 
by email 

+ Don't set a device activation password and communicate the BlackBerry UEM Self-Service address to 
the user so that they can set their own activation password and view a QR Code. 

. The user downloads BlackBerry UEM Client from Google Play and installs it on the device. After it is installed, 

the user opens the BlackBerry UEM Client and enters their email address and activation password or scans 

the QR Code. 

. The BlackBerry UEM Client on the device performs the following actions: 


a. Establishes a connection to the BlackBerry Infrastructure 
b. Sends arequest for activation information to the BlackBerry Infrastructure 
. The BlackBerry Infrastructure performs the following actions: 


a. Verifies that the user is a valid, registered user 

b. Retrieves the BlackBerry UEM address for the user 

c. Sends the address to the BlackBerry UEM Client 

. The BlackBerry UEM Client establishes a connection with BlackBerry UEM using an HTTP CONNECT call over 
port 443 and sends an activation request to BlackBerry UEM. The activation request includes the username, 
password, device operating system, and unique device identifier. 


. BlackBerry UEM performs the following actions: 


. Determines the activation type assigned to the user account 

. Connects to Google and creates a managed Google Play user 

. Creates a device instance 

. Associates the device instance with the specified user account 
. Adds the enrollment session ID to an HTTP session 


Sends the user's managed Google Play account information and a successful authentication message to 
the device 


. If the device is not encrypted, the user is prompted to encrypt the device. 
. The BlackBerry UEM Client performs the following actions: 
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a. Connects to Google to verify the user 


b. Creates a CSR using the information received from BlackBerry UEM and sends a client certificate request 
to BlackBerry UEM over HTTPS. 
. BlackBerry UEM performs the following actions: 


a. Validates the client certificate request against the enrollment session ID in the HTTP session 
b. Signs the client certificate request with the root certificate 
c. Sends the signed client certificate and root certificate back to the BlackBerry UEM Client 


A mutually authenticated TLS session is established between the BlackBerry UEM Client and BlackBerry UEM. 


10.The BlackBerry UEM Client requests all configuration information and sends the device and software 


information to BlackBerry UEM. 


11.BlackBerry UEM stores the device information in the database and sends the requested configuration 


information to the device. 


12.The device sends an acknowledgment to BlackBerry UEM that it received and applied the configuration 


information. The activation process is complete. 
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Data flow: Activating an Android device to have only a work profile in 
a Google domain 
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This data flow applies when BlackBerry UEM is connected to a Google Cloud or G Suite domain. For more 
information see the Configuration content. 


1. 


aS 


You perform the following actions: 


a. Verify that the user has a Google account that is associated with the user’s work email address. Optionally, 
you can configure BlackBerry UEM to create the Google account for the user during the activation process. 
When BlackBerry UEM creates the account for the user in Google, the user receives an email from 
the Google domain with their Google account password. 

b. If users have devices with Android 6.0 or later, verify that the "Enforce EMM Policy" setting is enabled for 
the Google domain. This setting specifies that activated devices are managed by an EMM provider, such 
as BlackBerry UEM. 

c. Add a user to BlackBerry UEM as a local user account or using the account information retrieved from your 
company directory. When you specify the email address, use the email address that is associated with the 
user's Google account. 

d. Make sure that the "Work space only" or "Work space only (Premium)" activation type is assigned to the 
user. 


e. Set the user's activation password. 


. For devices with a version of Android earlier than 6.0, BlackBerry UEM communicates with the Google domain 


to generate an activation token for the user. The activation token and the user's activation password are 
included in the activation email that is sent to the user's work email address. 


. The user resets their device to the factory default settings. 
. The device restarts and prompts the user to select a Wi-Fi network and to add an account. 
. The user performs one of the following actions: 


* For devices with a version of Android earlier than 6.0, taps the More button, taps "Setup work device," and 
enters their work email address and the activation token they received in their activation email 
* For devices with Android 6.0 and later, enters their work email address and password 


. The device performs one of the following actions: 


+ For devices with a version of Android earlier than 6.0, communicates with the Google domain to validate the 
activation token 


+ For devices with Android 6.0 and later, communicates with the Google domain to verify that the user is a 
work user and to check if the Enforce EMM Policy setting is enabled 


After the device performs the appropriate validations, the device performs the following actions: 
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a. If the device is not encrypted, prompts the user to encrypt the device and restarts 
b. Downloads the BlackBerry UEM Client from Google Play and installs it 

7. The BlackBerry UEM Client on the device prompts the user to type their email address and activation 
password. 

8. The user types their email address and activation password or scans the QR Code. 

9. The BlackBerry UEM Client on the device performs the following actions: 


a. Establishes a connection to the BlackBerry Infrastructure 
b. Sends arequest for activation information to the BlackBerry Infrastructure 
10.The BlackBerry Infrastructure performs the following actions: 


a. Verifies that the user is a valid, registered user 
b. Retrieves the BlackBerry UEM server address for the user 
c. Sends the server address to the BlackBerry UEM Client 

11.The BlackBerry UEM Client establishes a connection with BlackBerry UEM using an HTTP CONNECT call over 
port 443 and sends an activation request to BlackBerry UEM. The activation request includes the username, 
password, device operating system, and unique device identifier. 

12.BlackBerry UEM performs the following actions: 


. Determines the activation type assigned to the user account 
. Connects to the Google domain to verify the user information 
. Creates a device instance 
. Associates the device instance with the specified user account 
. Adds the enrollment session ID to an HTTP session 

f. Sends a successful authentication message to the device 
13.The BlackBerry UEM Client performs the following actions: 
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a. Prompts the user for the user's Google account information 
b. Connects to the Google domain to authenticate the user 
c. Creates a CSR using the information received from BlackBerry UEM and sends a client certificate request 
to BlackBerry UEM over HTTPS 
14.BlackBerry UEM performs the following actions: 


a. Validates the client certificate request against the enrollment session ID in the HTTP session 
b. Signs the client certificate request with the root certificate 
c. Sends the signed client certificate and root certificate back to the BlackBerry UEM Client 


A mutually authenticated TLS session is established between the BlackBerry UEM Client and BlackBerry UEM. 

15.The BlackBerry UEM Client requests all configuration information and sends the device and software 
information to BlackBerry UEM. 

16.BlackBerry UEM stores the device information and sends the requested configuration information to the 
device. 

17.The device sends an acknowledgment to BlackBerry UEM that it received and applied the configuration 
information. The activation process is complete. 
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Data flow: Activating an Android device to have only a work profile 
using a managed Google Play account 
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This data flow applies when you allow BlackBerry UEM to manage Google Play accounts. For more information 
see the Configuration content. 
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1. You perform the following actions: 


a. Add a user to BlackBerry UEM as a local user account or using the account information retrieved from your 
company director. 


b. Make sure that the "Work space only” or "Work space only (Premium)” activation type is assigned to the 
user 


c. Set the user's activation password 
. The user resets their device to the factory default settings. 
. The device restarts and prompts the user to select a Wi-Fi network and to add an account. 
. The user enters afw#blackberry instead of their Google user name. 
. The device performs the following actions: 
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a. If the device is not encrypted, prompts the user to encrypt the device and restarts 
b. Downloads the BlackBerry UEM Client from Google Play and installs it 


6. The BlackBerry UEM Client on the device prompts the user to type their email address and activation 
password. 


7. The user types their email address and activation password or scans the QR Code. 
8. The BlackBerry UEM Client performs the following actions: 


a. Establishes a connection to the BlackBerry Infrastructure 
b. Sends a request for activation information to the BlackBerry Infrastructure 
9. The BlackBerry Infrastructure performs the following actions: 


a. Verifies that the user is a valid, registered user 
b. Retrieves the BlackBerry UEM server address for the user 
c. Sends the server address to the BlackBerry UEM Client 


10.The BlackBerry UEM Client establishes a connection with BlackBerry UEM using an HTTP CONNECT call over 
port 443 and sends an activation request to BlackBerry UEM. The activation request includes the username, 
password, device operating system, and unique device identifier. 


11.BlackBerry UEM performs the following actions: 


a. Determines the activation type assigned to the user account 
b. Connects to Google and creates a managed Google Play user 
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. Creates a device instance 
. Associates the device instance with the specified user account 
. Adds the enrollment session ID to an HTTP session 


Sends the user's managed Google Play account information and a successful authentication message to 
the device 


12.The BlackBerry UEM Client performs the following actions: 
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a. Connects to Google to verify the user 


b. Creates a CSR using the information received from BlackBerry UEM and sends a client certificate request 
to BlackBerry UEM over HTTPS 
13.BlackBerry UEM performs the following actions: 


a. Validates the client certificate request against the enrollment session ID in the HTTP session 
b. Signs the client certificate request with the root certificate 
c. Sends the signed client certificate and root certificate back to the BlackBerry UEM Client 


A mutually authenticated TLS session is established between the BlackBerry UEM Client and BlackBerry UEM. 
14.The BlackBerry UEM Client requests all configuration information and sends the device and software 
information to BlackBerry UEM. 


15.BlackBerry UEM stores the device information in the database and sends the requested configuration 
information to the device. 


16.The device sends an acknowledgment to BlackBerry UEM that it received and applied the configuration 
information. The activation process is complete. 


Data flow: Activating a device to use KNOX Workspace 


BlackBerry UEM 
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1. You perform the following actions: 
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a. Add a user to BlackBerry UEM as a local user account or using the account information retrieved from your 
company directory 
b. Make sure the "Work and personal - full control (Samsung KNOX)", "Work and personal - user 
privacy (Samsung KNOX)", or "Work space only - (Samsung KNOX)" activation type is assigned to the user 
c. Use one of the following options to provide the user with activation details: 


+ Automatically generate a device activation password and, optionally, a QR Code and send an email with 
activation instructions for the user 
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+ Set a device activation password and communicate the username and password to the user directly or 
by email 
+ Don't set a device activation password and communicate the BlackBerry UEM Self-Service address to 
the user so that they can set their own activation password and view a QR Code. 
2. The user downloads and installs the BlackBerry UEM Client on the device. After it is installed, the user opens 
the BlackBerry UEM Client and enters the email address and activation password or scans the QR Code. 


3. The BlackBerry UEM Client performs the following actions: 


a. Establishes a connection to the BlackBerry Infrastructure 
b. Sends arequest for activation information to the BlackBerry Infrastructure 
4. The BlackBerry Infrastructure performs the following actions: 


a. Verifies that the user is a valid, registered user 
b. Retrieves the BlackBerry UEM address for the user 
c. Sends the address to the BlackBerry UEM Client 

5. The BlackBerry UEM Client establishes a connection with BlackBerry UEM using an HTTP CONNECT call over 
port 443 and sends an activation request to BlackBerry UEM. The activation request includes the username, 
password, device operating system, and unique device identifier. 

6. BlackBerry UEM performs following actions: 


Inspects the credentials for validity 

. Creates a device instance 

Associates the device instance with the specified user account in the BlackBerry UEM database 

. Adds the enrollment session ID to an HTTP session 

. Sends a successful authentication message to the device 

7. The BlackBerry UEM Client creates a CSR using the information received from BlackBerry UEM and sends a 
client certificate request to BlackBerry UEM over HTTPS. 


8. BlackBerry UEM performs the following actions: 


o20 09 


a. Validates the client certificate request against the enrollment session ID in the HTTP session 
b. Signs the client certificate request with the root certificate 
c. Sends the signed client certificate and root certificate back to the BlackBerry UEM Client 


A mutually authenticated TLS session is established between the BlackBerry UEM Client and BlackBerry UEM. 

9. The BlackBerry UEM Client requests all configuration information and sends the device and software 
information to BlackBerry UEM. 

10.BlackBerry UEM stores the device information in the database and sends the requested configuration 
information to the device. 

11.The BlackBerry UEM Client determines if the device uses KNOX Workspace and is running a supported 
version. If the device uses KNOX Workspace, the device connects to the Samsung infrastructure and activates 
the KNOX management license. After it is activated, the BlackBerry UEM Client applies the KNOX MDM 
and KNOX Workspace IT policy rules. 

12.The device sends an acknowledgment to BlackBerry UEM that it received and applied the configuration 
information. The activation process is complete. 


After the activation is complete, the user is prompted to create a work space password for the KNOX Workspace. 
Data in the KNOX Workspace is protected using encryption and a method of authentication such as a password, 
PIN, pattern, or fingerprint. 


Note: If the device is activated with the "Work space only - (Samsung KNOX)" activation type, the personal space 
is removed when the KNOX Workspace is set up. 
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Data flow: Activating an iOS device 
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1. If you plan to use Apple's Device Enrollment Program, you perform the following actions: 


a. Make sure that BlackBerry UEM is configured to synchronize with DEP 
b. Register the device in DEP and assign it to an MDM server 
c. Assign an enrollment configuration to the device 

2. You perform the following actions: 


a. Add a user to BlackBerry UEM as a local user account or using the account information retrieved from your 
company directory 


b. Assign an activation profile to the user 
c. Use one of the following options to provide the user with activation details: 


+ Automatically generate a device activation password and, optionally, a QR Code and send an email with 
activation instructions for the user 

* Seta device activation password and communicate the username and password to the user directly or 
by email 

+ Don't set a device activation password and communicate the BlackBerry UEM Self-Service address to 
the user so that they can set their own activation password and view a QR Code. 


3. If the device is registered in the Apple DEP, the device communicates with the Apple DEP web service during 
its initial setup. If you configured the device to install the BlackBerry UEM Client app, the device automatically 
downloads and installs it. 


4. If the device is not registered in the Apple DEP or if you did not configure the device to install the BlackBerry 
UEM Client, the user manually downloads and installs the BlackBerry UEM Client on the device. After it is 
installed, the user opens the BlackBerry UEM Client and enters the email address and activation password or 
scans the QR Code. 


5. The BlackBerry UEM Client performs the following actions: 


a. Establishes a connection to the BlackBerry Infrastructure 
b. Sends a request for activation information to the BlackBerry Infrastructure 
6. The BlackBerry Infrastructure performs the following actions: 


a. Verifies that the user is a valid, registered user 
b. Retrieves the BlackBerry UEM address for the user 
c. Sends the address to the BlackBerry UEM Client 
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7. The BlackBerry UEM Client establishes a connection with BlackBerry UEM using an HTTP CONNECT call over 
port 443 and sends an activation request to BlackBerry UEM. The activation request includes the username, 
password, device operating system, and unique device identifier. 

8. BlackBerry UEM performs following actions: 


a. Inspects the credentials for validity 
b. Creates a device instance 
c. Associates the device instance with the specified user account in the BlackBerry UEM database 
d. Adds the enrollment session ID to an HTTP session 
e. Sends a successful authentication message to the device 
9. The BlackBerry UEM Client creates a CSR using the information received from BlackBerry UEM and sends a 
client certificate request over HTTPS. 
10.BlackBerry UEM performs the following actions: 


a. Validates the client certificate request against the enrollment session ID in the HTTP session 
b. Signs the client certificate request with the root certificate 
c. Sends the signed client certificate and root certificate back to the BlackBerry UEM Client 


A mutually authenticated TLS session is established between the BlackBerry UEM Client and BlackBerry UEM. 

11.The BlackBerry UEM Client displays a message to inform the user that a certificate must be installed to 
complete the activation. The user clicks OK and is redirected to the link for the native MDM Daemon activation. 
The BlackBerry UEM Client establishes a connection to BlackBerry UEM. 

12.BlackBerry UEM provides the MDM profile to the device. This profile contains the MDM activation URL and the 
challenge. The MDM profile is wrapped as a PKCS#7 signed message that includes the full certificate chain of 
the signer, which allows the device to validate the profile. This triggers the enrollment process. 

13.The native MDM Daemon on the device sends the device profile, including the customer ID, language, and OS 
version, to BlackBerry UEM. 

14.BlackBerry UEM validates that the request is signed by a CA and responds to the native MDM Daemon with a 
successful authentication notification. 

15.The native MDM Daemon sends a request to BlackBerry UEM asking for the CA certificate, CA capabilities 
information, and a device-issued certificate. 

16.BlackBerry UEM sends the CA certificate, CA capabilities information, and the device-issued certificate to the 
native MDM Daemon. 

17.The native MDM Daemon installs the MDM profile on the device. The BlackBerry UEM 
Client notifies BlackBerry UEM of the successful installation of the MDM profile and certificate and 
polls BlackBerry UEM periodically until it acknowledges that the MDM activation is complete. 

18.BlackBerry UEM acknowledges that the MDM activation is complete. 

19.The BlackBerry UEM Client requests all configuration information and sends the device and software 
information to BlackBerry UEM. 

20.BlackBerry UEM stores the device information in the database and sends configuration information to the 
device. 

21.The device sends an acknowledgment to BlackBerry UEM that it received and applied the configuration 
updates. The activation process is complete. 
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Data flow: Activating a macOS device 
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You make sure that the user has a BlackBerry UEM user account and the login information for BlackBerry UEM 
Self-Service, including: 

* Web address for BlackBerry UEM Self-Service 

* Username and password 

* Domain name 


. The user logs in to BlackBerry UEM Self-Service on their macOS device and activates the device. 
. The device sends an activation request to BlackBerry UEM on port 443. 
. BlackBerry UEM provides the MDM profile to the device. This profile contains the MDM activation URL and the 


challenge. The MDM profile is wrapped as a PKCS#7 signed message that includes the full certificate chain of 
the signer, which allows the device to validate the profile. This triggers the enrollment process. 


. The native MDM Daemon on the device sends the device profile, including the customer ID, language, and OS 


version, to BlackBerry UEM. 


. BlackBerry UEM validates that the request is signed by a CA and responds to the native MDM Daemon with a 


successful authentication notification. 


. The native MDM Daemon sends a request to BlackBerry UEM asking for the CA certificate, CA capabilities 


information, and a device issued certificate. 

BlackBerry UEM sends the CA certificate, CA capabilities information, and the device issued certificate to the 
native MDM Daemon. 

The native MDM Daemon installs the MDM profile on the device. 


10.BlackBerry UEM acknowledges that the MDM activation is complete. 
11.The device requests all configuration information. 
12.BlackBerry UEM stores the device information in the database and sends configuration information to the 


device. 


13.The device sends an acknowledgment to BlackBerry UEM that it received and applied the configuration 


information. The activation process is complete. 
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Data flow: Activating a Windows 10 device 
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1. You perform the following actions: 


a. Configure the discovery service to simplify Windows 10 activations 

b. Add a user to BlackBerry UEM as a local user account or using the account information retrieved from your 
company directory 

c. Use one of the following options to provide the user with activation details: 


+ Automatically generate a device activation password and send an email with activation instructions for 
the user. 

+ Seta device activation password and select the option to send the activation information to the user by 
email. 

+ Don't set a device activation password and communicate the BlackBerry UEM Self-Service address to 
the user so that they can set their own activation password and view their server address. 

d. Provide the user a CA certificate generated by BlackBerry UEM to install on their device 
2. The user completes the following actions on their device: 


a. Checks that the device has Internet connectivity on port 443 
b. Opens and installs the certificate 
c. Navigates to Settings > Accounts > Work access and taps Connect 
d. When prompted, enters their email address and activation password they received on the activation email 
3. The device establishes a connection to the discovery service that you configured to simplify Windows 
10 activations in your organization. 
4. The discovery service checks that the SRP ID for the BlackBerry UEM server is valid and redirects the device 
to BlackBerry UEM. 
5. The device sends an activation request to BlackBerry UEM on port 443. The activation request includes the 
username, password, device operating system, and unique device identifier. 
6. BlackBerry UEM performs following actions: 


Inspects the credentials for validity 

. Creates a device instance 

Associates the device instance with the specified user account in the BlackBerry UEM database 

. Adds the enrollment session ID to an HTTP session 

. Sends a successful authentication message to the device 

7. The device creates a CSR and sends it to BlackBerry UEM over HTTPS. The CSR contains the username and 
activation password. 
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8. BlackBerry UEM validates the username and password, validates the CSR, and returns the client certificate and 
the CA certificate to the device. 


All communication between the device and BlackBerry UEM is now mutually authenticated end to end using 
these certificates. 

9. The device requests all configuration information. 

10.BlackBerry UEM stores the device information in the database and sends configuration information to the 
device. 

11.The device sends an acknowledgment to BlackBerry UEM that it received and applied the configuration 
information. The activation process is complete. 
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Data flow: Activating a BlackBerry OS device 
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7 ___: Optional components 


1. You use the management console to create a new user account and use one of the following options to 
provide the user with activation details: 


+ Automatically generate a device activation password and send an email with activation instructions for the 
user 

* Seta device activation password and communicate the username and password to the user directly or by 
email 

* Don't set a device activation password and communicate the BlackBerry Web Desktop Manager address to 
the user so that they can set their own activation password 


The device user list stored in the BlackBerry UEM database is updated with the new device user name, email 
address, mailbox information, activation password, activation status, and other information. 

2. The BlackBerry Dispatcher for BlackBerry OS assigns the new user to a BlackBerry Messaging Agent. 

The BlackBerry Messaging Agent starts to monitor the user's mailbox on the mail server for new email. An 
email containing an etp.dat file attachment is required to continue the activation process. 

3. The device user navigates to the Enterprise Activation screen on the BlackBerry OS (version 5.0 to 7.1) device 
and types the email address and activation password. The device user opens the menu and clicks Activate. 
The device displays "Activating." 

4. The device creates an activation request email that contains the email address, device PIN, and public key 
authentication information, based on the enterprise activation password the user typed. The device encrypts 
the email using SPEKE and sends it to the BlackBerry Infrastructure. 

5. The BlackBerry Infrastructure receives the activation request email and identifies it as an activation request. 
The BlackBerry Infrastructure forwards the email using SMTP to the email address that the user typed on the 
Enterprise Activation screen. 
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6. When the activation request email arrives in the user's mailbox, the BlackBerry Messaging Agent identifies it 
and removes it from the user's mailbox. The BlackBerry Messaging Agent recognizes the etp.dat attachment in 
the activation request email and begins an authentication process. 

7. The BlackBerry Messaging Agent compares the authentication key received in the activation request 
email with the authentication key generated from the activation password and stored in the BlackBerry 
UEM database. If the authentication keys match, the BlackBerry Messaging Agent notifies the BlackBerry OS 
device that the activation request was received. 

8. BlackBerry UEM and the BlackBerry OS device establish an encryption key and verify their knowledge of the 
encryption key to each other. 


The BlackBerry OS device displays "Encryption Verified. Waiting for Services." 


All the data sent between the BlackBerry OS device and BlackBerry UEM from now on is compressed and 
encrypted using this encryption key and the device can now be managed from the management console. 

9. The BlackBerry Messaging Agent forwards a request to the BlackBerry Policy Service to generate service 
books. The BlackBerry Policy Service receives and queues the request. The BlackBerry Policy Service adds 
the unique authentication key that the BlackBerry UEM domain uses to sign IT policy data and then forwards 
the IT policy data through the BlackBerry Dispatcher for BlackBerry OS to the device. The BlackBerry Policy 
Service waits for confirmation from the device that the IT policy has been applied successfully. 

10.The BlackBerry OS device applies the IT policy and sends a confirmation to BlackBerry UEM. The IT policy 
applied to the BlackBerry OS device is now in a read-only state and can be modified only by updates sent from 
the same BlackBerry UEM domain. 

11.Once the BlackBerry Policy Service receives confirmation that the IT policy was applied successfully, 
the BlackBerry Policy Service generates and sends the service books to the BlackBerry OS device. 

12.The BlackBerry OS device receives the service books. The device user is notified that the email address has 
been activated. 


The BlackBerry OS device displays "Services Received. Your email address, <username>@<domain>.com is now 
enabled." 


The device user can now send and receive email messages on the BlackBerry OS device. 

13.The slow synchronization process begins. The BlackBerry OS device requests the synchronization 
configuration information from the BlackBerry Synchronization Service. The configuration information 
indicates whether wireless data synchronization on BlackBerry UEM is turned on and which organizer 
databases can be synchronized. The configuration information also provides database synchronization types 
(unidirectional or bidirectional) and conflict resolution settings. 

14.The BlackBerry Synchronization Service returns the configuration information and synchronizes the databases 
on the BlackBerry OS device using that information. 


The BlackBerry OS device and BlackBerry UEM do not delete records during the initial synchronization process. 


15.The slow synchronization process is complete when all databases are synchronized between 
the BlackBerry OS device and BlackBerry UEM. 


The activation process is complete when the BlackBerry OS device displays “Activation Complete” and the 
device user account status displays “Completed” in the management console or BlackBerry Administration 
Service. 
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Sending and receiving work data 


When devices that are active on BlackBerry UEM send and receive work data, they connect to your organization's 
mail, application, or content servers. For example, when they use the work email or calendar apps, devices 
establish a connection to your organization's mail server. When they use the work browser to navigate the 
intranet, devices establish a connection to the web server in your organization, and so on. 


Depending on the type of device, the activation type, license types, and configuration settings, a device may 
establish connections to your organization's servers using the following paths: 


| Data Path | Description | 


Work Wi-Fi network You can use BlackBerry UEM to configure Wi-Fi profiles for devices so that devices 
can connect to your organization's resources using your work Wi-Fi network. 








You can use BlackBerry UEM to configure VPN profiles for devices or users may 
configure VPN profiles on their devices so that devices can connect to your 
organization's resources using a VPN. 


BlackBerry UEM and the Depending on the device, activation, and license type, and on the presence of 
BlackBerry Infrastructure | BlackBerry Dynamics apps, devices may be able to use enterprise connectivity to 
or BlackBerry Dynamics communicate with your organization's resources through BlackBerry UEM and the 
NOC BlackBerry Infrastructure. 


+ BlackBerry 10 devices can use enterprise connectivity for all work data. 
Enterprise connectivity encrypts and authenticates all work data and sends 
it through BlackBerry UEM and the BlackBerry Infrastructure. Enterprise 
connectivity limits the number of ports that you need to open on your 
organization's external firewall to a single port, 3101. 
For iOS devices, if the devices have an appropriate license, you can enable 
the BlackBerry Secure Gateway to allow devices to connect to your work mail 
server through the BlackBerry Infrastructure and BlackBerry UEM. If you use 
the BlackBerry Secure Gateway, you don't have to expose your mail server 
outside of the firewall to allow users with iOS devices to connect to Microsoft 
Exchange when they are not connected to your VPN or work Wi-Fi network. 
For BlackBerry 10 and iOS devices, and Android devices activated to have 
a work profile or use Samsung KNOX Workspace, if the devices have an 
appropriate license, you can use enterprise connectivity by enabling BlackBerry 
Secure Connect Plus. When devices use BlackBerry Secure Connect Plus, work 
data travels in a secure IP tunnel established between apps on the device and 
your organization's network through the BlackBerry Infrastructure. 
BlackBerry Dynamics apps installed on devices communicate with BlackBerry 
Proxy. Data can travel through the BlackBerry Dynamics NOC or can bypass the 
NOC using BlackBerry Dynamics Direct Connect. 
BlackBerry OS (version 5.0 to 7.1) devices always connect to BlackBerry UEM 
to send or receive work data. BlackBerry UEM then establishes a connection 
to your organization's mail, application, or content servers to send and receive 
work data to and from the devices. For more information about data flows for 
BlackBerry OS (version 5.0 to 7.1) devices, see the BES5 Feature and Technical 
Overview. 
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Sending and receiving work data using the BlackBerry Infrastructure 


Devices connect to BlackBerry UEM through the BlackBerry Infrastructure to obtain configuration updates and 

to send and receive work data using enterprise connectivity or the BlackBerry Secure Gateway. The following 
diagram shows how devices connect to BlackBerry UEM and your organization's resources through the BlackBerry 
Infrastructure. 
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The following table lists the circumstances when devices connect to BlackBerry UEM and your organization's 
network through the BlackBerry Infrastructure. 


Device type Description 





All devices All devices use this communication path to send and receive configuration 
data, such as device commands, policy and profile updates, and to send 
device information and activity reports. For more information, see Receiving 
device configuration updates. 


BlackBerry 10 devices BlackBerry 10 devices use this communication path to send and receive work 
data when this is the most direct, cost-efficient route available. 


iOS devices You can enable the BlackBerry Secure Gateway to allow iOS devices 
to connect to your work mail server through the BlackBerry 
Infrastructure and BlackBerry UEM. If you use the BlackBerry Secure Gateway, 
you don't have to expose your mail server outside of the firewall to allow users 
to receive work email when they are not connected to your organization's VPN 
or work Wi-Fi network. 
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Device type Description 





BlackBerry Devices that have an enterprise connectivity profile configured to 

10 devices, iOS devices, use BlackBerry Secure Connect Plus can use a secure IP tunnel through 
and Android devices with the BlackBerry Infrastructure to transfer data between apps and your 

a work profile or Samsung organization's network. 


Se creas For BlackBerry 10 and Android devices with a work profile, BlackBerry Secure 


Connect Plus provides a secure tunnel between all work space apps and your 
organization's network. 


For Samsung KNOX Workspace devices, BlackBerry Secure Connect Plus can 
provide a secure tunnel between your organization's network and all work 
apps or only specified work apps. 


For iOS devices, BlackBerry Secure Connect Plus can provide a secure tunnel 
between your organization's network and all apps or only specified apps. 


iOS and Android devices Enterprise connectivity for BlackBerry Dynamics apps does not use 

with BlackBerry the BlackBerry Infrastructure. Instead, data in transit between BlackBerry 

Dynamics apps installed Dynamics apps and BlackBerry Proxy can travel through the BlackBerry 
Dynamics NOC or can bypass the NOC using BlackBerry Dynamics Direct 
Connect. 


BlackBerry OS (version 5.0to BlackBerry OS (version 5.0 to 7.1) devices use this communication path to 
7.1) devices send and receive email, organizer, and app data updates when this is the most 
direct, cost-efficient route available. 





Related concepts 
Sending and receiving work data using a VPN or work Wi-Fi network 


Data flow: Accessing an application or content server from a BlackBerry 10 device 


This data flow describes how data travels when a work app on a BlackBerry 10 device accesses an application or 
content server in your organization when BlackBerry Secure Connect Plus is not enabled. 
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1. The user opens a work app to view work data. For example, the user opens the work browser to navigate the 
intranet or uses BlackBerry Work Drives to access a file on a network drive. 

2. The app establishes a connection to the application or content server to retrieve the data. The request travels 
through the BlackBerry Infrastructure, BlackBerry Affinity Manager, BlackBerry Dispatcher, and BlackBerry MDS 
Connection Service to the application or content server. 

3. The application or content server replies with the work data. The work data travels through the BlackBerry 
MDS Connection Service, BlackBerry Dispatcher, BlackBerry Affinity Manager, and BlackBerry Infrastructure to 
device. 


4. The app receives and displays the data on the device. 


Related concepts 


Data flow: Accessing an application or content server using BlackBerry Secure Connect Plus 
Data flow: Accessing an application or content server using a VPN or work Wi-Fi network 
Data flow: Sending email from a BlackBerry 10 device 


This data flow describes how work email and calendar data travels from BlackBerry 10 devices to the Exchange 
ActiveSync server when BlackBerry Secure Connect Plus in not enabled. 
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1. Auser creates an email or updates an organizer item in the work space. 

2. The device sends the new or changed item through the BlackBerry Infrastructure, BlackBerry Affinity 
Manager, BlackBerry Dispatcher, and BlackBerry MDS Connection Service to the mail server. 

3. The mail server updates the organizer data on the user's mailbox or sends the mail item to the recipient and 
sends a confirmation to the device. 
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Related concepts 


Data flow: Sending email from an iOS device using the BlackBerry Secure Gateway 
Data flow: Sending email from a device using a VPN or work Wi-Fi network 


Data flow: Receiving email on a BlackBerry 10 device 


This data flow describes how work email messages are received from the Exchange ActiveSync server 
on BlackBerry 10 devices when BlackBerry Secure Connect Plus is not enabled. 
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1. The native email client on the device maintains a permanent connection with the email server over 
an encrypted and authenticated channel through the BlackBerry Infrastructure, BlackBerry Affinity 
Manager, BlackBerry Dispatcher, and BlackBerry MDS Connection Service and detects changes in the folders 
configured for synchronization on the mail server. 

2. When there are new or changed items for the device, such as a new email message or updated calendar entry, 
the mail server sends the updates to the device through the BlackBerry MDS Connection Service, BlackBerry 
Dispatcher, BlackBerry Affinity Manager, and BlackBerry Infrastructure to the email or organizer app on the 
device using the Exchange ActiveSync protocol. 


Related concepts 


Data flow: Receiving email on an iOS device using the BlackBerry Secure Gateway 
Data flow: Receiving email on a device using a VPN or work Wi-Fi network 


Data flow: Receiving enterprise push updates on a BlackBerry 10 device 


This data flow describes how work data travels from an application server to an appropriate app in the work 
space of a BlackBerry 10 device when BlackBerry Secure Connect Plus is not enabled. 
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1. When there is new or updated data for a work app on a BlackBerry 10 device, the application or content server 
pushes the data to the BlackBerry MDS Connection Service using an HTTP or HTTPS request. 

2. The BlackBerry MDS Connection Service sends the pushed data through the BlackBerry Dispatcher, BlackBerry 
Affinity Manager, and BlackBerry Infrastructure over port 3101 on the firewall. 
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3. The BlackBerry Infrastructure sends the data to the BlackBerry 10 device. 

4. The BlackBerry 10 device sends a delivery confirmation to the BlackBerry Infrastructure. The device app 
detects the incoming content and displays the content when the user opens the app. 

5. The BlackBerry Infrastructure sends a delivery confirmation through the BlackBerry Affinity Manager and 
the BlackBerry Dispatcher to the BlackBerry MDS Connection Service. 

6. If configured to do so, the BlackBerry MDS Connection Service sends the delivery confirmation to the push 
initiator using an HTTP request. 


Data flow: Sending email from an iOS device using the BlackBerry Secure Gateway 


This data flow describes how work email and calendar data travels from iOS devices to the Exchange 
ActiveSync server using the BlackBerry Secure Gateway. 
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1. A.user creates an email or updates an organizer item in the work space. 

2. The device sends the new or changed item through the BlackBerry Infrastructure and the BlackBerry Secure 
Gateway to the mail server. 

3. The mail server updates the organizer data on the user's mailbox or sends the mail item to the recipient and 
sends a confirmation to the device. 


Related concepts 


Data flow: Sending email from a BlackBerry 10 device 
Data flow: Sending email from a device using a VPN or work Wi-Fi network 


Data flow: Receiving email on an iOS device using the BlackBerry Secure Gateway 


This data flow describes how work email and calendar data travels between iOS devices and the Exchange 
ActiveSync server using the BlackBerry Secure Gateway. 
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; _ Optional components 


1. The native email client on iOS maintains a permanent connection with the email server over an encrypted and 
authenticated channel between the BlackBerry Infrastructure and the BlackBerry Secure Gateway and detects 
changes in the folders configured for synchronization on the mail server. 

2. When there are new or changed items for the device, such as a new email message or updated calendar entry, 
the mail server sends the updates to the device through the secure channel between the BlackBerry Secure 
Gateway and the BlackBerry Infrastructure to the email or organizer app on the device using the Exchange 
ActiveSync protocol. 


Related concepts 


Data flow: Receiving email on a BlackBerry 10 device 
Data flow: Receiving email on a device using a VPN or work Wi-Fi network 


Data flow: Accessing an application or content server using BlackBerry Secure Connect Plus 


This data flow describes how data travels when an app on a device that is configured to use BlackBerry Secure 
Connect Plus accesses an application or content server in your organization. 


This data flow does not apply to BlackBerry Dynamics apps in the work space on Android devices with a work 
profile or Samsung KNOX Workspace devices. For more information see, Data flow: Sending and receiving work 
data from a BlackBerry Dynamics app on an Android device using BlackBerry Secure Connect Plus 
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' - a Optional components 


1. The user opens an app to access work data from a content or application server behind your organization's 
firewall. 


* For BlackBerry 10 devices and Android devices with a work profile, all work space apps use BlackBerry 
Secure Connect Plus. 
* For iOS devices, you specify whether all apps or only specified apps use BlackBerry Secure Connect Plus. 
+ For Android devices with a work profile, all work space apps except those you choose to restrict 
use BlackBerry Secure Connect Plus. 
+ For Samsung KNOX Workspace devices, you specify whether all work space apps or only specified work 
apps use BlackBerry Secure Connect Plus. 
2. The device sends a requests through a TLS tunnel, over port 443, to the BlackBerry Infrastructure to request 
a secure tunnel to the work network. The signal is encrypted by default using FIPS-140 certified Certicom 
libraries. The signaling tunnel is encrypted end-to-end. 
BlackBerry Secure Connect Plus receives the request from the BlackBerry Infrastructure through port 3101. 
4. The device and BlackBerry Secure Connect Plus negotiate the tunnel parameters and establish a secure tunnel 
for the device through the BlackBerry Infrastructure. The tunnel is authenticated and encrypted end-to-end with 
DTLS. 
5. The app uses the tunnel to connect to the application or content server using standard IPv4 protocols (TCP 
and UDP). 
6. BlackBerry Secure Connect Plus transfers the IP data to and from your organization's network. BlackBerry 
Secure Connect Plus encrypts and decrypts traffic using FIPS-140 certified Certicom libraries. 
7. The app receives and displays the data on the device. 
8. As long as the tunnel is open, supported apps use it to access network resources. When the tunnel is no 
longer the best available method to connect to your organization's network, BlackBerry Secure Connect 
Plus terminates it. 


w 


Related concepts 


Data flow: Accessing an application or content server from a BlackBerry 10 device 
Data flow: Accessing an application or content server using a VPN or work Wi-Fi network 
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Data flow: Sending and receiving work data from a BlackBerry Dynamics app 


This data flow describes how data travels when a BlackBerry Dynamics app accesses an application or content 
server in your organization through BlackBerry UEM. 
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_| Optional components 


The user opens a BlackBerry Dynamics app to access work data. 

. The BlackBerry Dynamics app establishes a connection to the BlackBerry Dynamics NOC. The connection is 

authenticated with the master link key that was created when the app was activated. 

3. The BlackBerry Dynamics NOC communicates with BlackBerry Proxy over a pre-established secure connection 
to establish an end-to-end connection between the BlackBerry Dynamics app and BlackBerry Proxy that carries 
the work data. The work data is encrypted with a session key that is not known to the BlackBerry Dynamics 
NOC. 

4. When the secure end-to-end connection is established, work data can travel between the device and 

application or content servers behind the firewall via BlackBerry Proxy. 


yO = 


Data flow: Sending and receiving work data from a BlackBerry Dynamics app using BlackBerry 
Dynamics Direct Connect 


This data flow describes how data travels when a BlackBerry Dynamics app accesses an application or content 
server in your organization through BlackBerry Dynamics Direct Connect and BlackBerry UEM. 
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1. The user opens a BlackBerry Dynamics app to access work data. 

2. The BlackBerry Dynamics app establishes a TLS connection to BlackBerry Proxy. 

3. BlackBerry Proxy authenticates with the BlackBerry Dynamics app. BlackBerry Proxy authenticates with the 
app using its server certificate. BlackBerry Proxy validates the app using a MAC keyed with a session key 
known only to BlackBerry Proxy and the app. 

4. When the secure end-to-end connection is established, work data can travel between the device and 
application or content servers behind the firewall via BlackBerry Proxy. 


Data flow: Sending and receiving work data from a BlackBerry Dynamics app on an Android device 
using BlackBerry Secure Connect Plus 


This data flow describes how data travels when a BlackBerry Dynamics app on an Android Enterprise or Samsung 
KNOX Workspace device uses BlackBerry Secure Connect Plus. 


If you are using BlackBerry Secure Connect Plus with BlackBerry Dynamics apps on an Android Enterprise device, 
it is recommended that you restrict BlackBerry Dynamics apps from using BlackBerry Secure Connect Plus to 
avoid network latency. You can't restrict specific apps on Samsung KNOX Workspace devices. 


If you are using BlackBerry Secure Connect Plus with BlackBerry Dynamics apps on an Android Enterprise device 
or a Samsung KNOX Workspace device, it is recommended that you configure BlackBerry UEM not to 
send BlackBerry Dynamics app data through the BlackBerry Dynamics NOC to reduce network latency. 
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1 _ : Optional components 


. The user opens a BlackBerry Dynamics app to access work data. 
. The device sends a request through a TLS tunnel, over port 443, to the BlackBerry Infrastructure to 


request a secure tunnel to the work network. The signal is encrypted by default using FIPS-140 

certified Certicom libraries. The signaling tunnel is encrypted end to end. 

BlackBerry Secure Connect Plus receives the request from the BlackBerry Infrastructure through port 3101. 
The device and BlackBerry Secure Connect Plus negotiate the tunnel parameters and establish a secure tunnel 
for the device through the BlackBerry Infrastructure. The tunnel is authenticated and encrypted end to end with 
DTLS. 

BlackBerry Secure Connect Plus establishes a connection with BlackBerry Proxy. 

The BlackBerry Dynamics app establishes a connection to BlackBerry Proxy using the BlackBerry Secure 
Connect Plus tunnel. 

BlackBerry Proxy authenticates with the BlackBerry Dynamics app using its server certificate. BlackBerry 
Proxy validates the app using a MAC keyed with a session key known only to BlackBerry Proxy and the app. 
When the secure connection is established between BlackBerry Proxy and the app, work data can travel 
between the device and application or content servers behind the firewall using the BlackBerry Secure Connect 
Plus tunnel to BlackBerry Proxy. BlackBerry Secure Connect Plus encrypts and decrypts traffic using FIPS-140 
certified Certicom libraries. 
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Sending and receiving work data using a VPN or work Wi-Fi network 


Devices that have VPN or Wi-Fi profiles configured by you or by the users, may be able to access your 
organization's resources using your organization's VPN or work Wi-Fi network. To use your organization's VPN, 
users with an Android device that does not have a work profile or Samsung KNOX Workspace must manually 
configure a VPN profile on their devices. 


This diagram shows how data can travel when a BlackBerry 10, iOS, Android, Windows, or macOS device connects 
to your organization's resources using your organization's VPN or work Wi-Fi network. 
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This diagram shows how data can travel when a BlackBerry OS (version 5.0 to 7.1) device connects to your 
organization's resources using your organization's VPN or work Wi-Fi network. 
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The following table describes when devices use your organization's VPN or work Wi-Fi network to connect to your 
organization's network. 


| Device type Description | 


Android devices with a work profile | By default, Android devices that have a work profile or use KNOX 

and KNOX Workspace devices Workspace use your organization's VPN or work Wi-Fi network to send 
and receive work data only when BlackBerry Secure Connect Plus is not 
enabled. 
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Device type Description 





Windows and macOS devices, Windows and macOS devices and Android devices with the MDM 

and Android devices with the MDM __ controls activation type your organization's VPN or work Wi- 

controls activation type Fi network to send and receive work data. To use your organization's 
VPN, Android device users must manually configure a VPN profile on 
their devices. 


iOS iOS devices use your organization's VPN or work Wi-Fi network to 
send and receive Exchange ActiveSync data if the BlackBerry Secure 
Gateway is not enabled. All other work data uses your organization's 
VPN or work Wi-Fi network. 


BlackBerry 10 BlackBerry 10 devices use your organization's VPN or work Wi- 
Fi network to send and receive work data when this is the most direct, 
cost-efficient route available. BlackBerry 10 devices use only VPN 
and Wi-Fi profiles configured by you, not by the user, when accessing 
work data. 


BlackBerry OS BlackBerry OS (version 5.0 to 7.1) devices use your organization's VPN 
or work Wi-Fi network to send and receive all email, organizer, and app 
data updates when this is the most direct, cost-efficient route available. 





Related concepts 
Sending and receiving work data using the BlackBerry Infrastructure 


Data flow: Sending email from a device using a VPN or work Wi-Fi network 


This data flow describes how work email and calendar data travels from the device to the mail server over your 
organization's VPN or work Wi-Fi network using Exchange ActiveSync. 
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1. Auser creates an email or updates an organizer item in the work space. 


2. The device sends the new or changed item to the mail server over your organization's VPN or work Wi- 
Fi network. 


3. The mail server updates the organizer data on the user's mailbox or sends the mail item to the recipient and 
sends a confirmation to the device. 
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Related concepts 


Data flow: Sending email from a BlackBerry 10 device 
Data flow: Sending email from an iOS device using the BlackBerry Secure Gateway 
Data flow: Receiving email on a device using a VPN or work Wi-Fi network 


This data flow describes how work email and calendar data travels from the device to the mail server over your 
organization's VPN or work Wi-Fi network using Exchange ActiveSync. 
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1. The device issues an HTTPS request to the mail server and requests that the mail server notify the device 
when any items change in the folders that are configured to synchronize. The request travels through your 
organization's VPN or work Wi-Fi network to the mail server. 

2. The device stands by. 

3. When there are new or changed items for the device, such as a new email or updated calendar entry, the mail 
server sends the updates to the device. The new or changed items travel through your organization's VPN or 
work Wi-Fi network to the email or organizer data app on the device. 


4. When the synchronization is complete, the device issues another request to restart the process. 


5. If there are no new or changed items during this interval, the mail or application server sends a message to the 
device using the Exchange ActiveSync protocol. 


6. The device issues a new request and the process starts over. 


Related concepts 


Data flow: Receiving email on a BlackBerry 10 device 
Data flow: Receiving email on an iOS device using the BlackBerry Secure Gateway 


Data flow: Accessing an application or content server using a VPN or work Wi-Fi network 


This data flow describes how data travels between an application or content server in your organization and an 
app on a device using a VPN connection or a work Wi-Fi network. 
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1. The user opens a work app to view work data. For example, the user opens the work browser to navigate the 
intranet or uses an internally developed app to access your organization's customer data. 


2. The app establishes a connection to the application or content server to retrieve the data. The request travels 
through your VPN or work Wi-Fi network to the application or content server. 


3. The application or content server replies with the work data. The work data travels through your VPN or 
work Wi-Fi network to the app on the work space of the device. 


4. The app receives and displays the data on the device. 


Related concepts 


Data flow: Accessing an application or content server from a BlackBerry 10 device 
Data flow: Accessing an application or content server using BlackBerry Secure Connect Plus 
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Receiving device configuration updates 


When you use the management console to send device commands, such as lock device or delete the work data, 
or when you perform other device management tasks, such as updates to policy, profile, and app settings or 
assignments, you trigger a configuration update for the device. 


When a configuration update needs to be sent to a device, BlackBerry UEM notifies the device that a configuration 
update is pending. Devices also poll BlackBerry UEM regularly to ask for any actions that need to be run on the 
device to prevent any configuration update from being missed if a notification is not received on the device. 


On BlackBerry 10 devices, the Enterprise Management Agent receives and completes all configuration updates. 
On Android devices, the BlackBerry UEM Client receives and completes all configuration updates. 


On iOS devices, the BlackBerry UEM Client app displays compliance status and configuration information for the 
device, such as apps or policies assigned to it. However, the native MDM Daemon on the device receives and 
completes all configuration updates sent to the device. 


On Windows 10 and macOS devices, which do not require the BlackBerry UEM Client for activation, the native 
MDM Daemon receives and completes all configuration updates sent to the device. 
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Data flow: Activating a BlackBerry Dynamics app 


This data flow describes how data travels when a BlackBerry Dynamics app is activated. 
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. An administrator assigns one or more BlackBerry Dynamics apps to a user. 

. The user installs the app on the device. 

3. If the device is not a Samsung KNOX Workspace device and the BlackBerry UEM Client is installed on the 
device, the BlackBerry Dynamics app performs the following actions: 


N 


a. Establishes a secure channel with the BlackBerry UEM Client on the device. Data exchanged over the 
secure channel is encrypted using an AES-CBC cipher. 
b. Asks the BlackBerry UEM Client to request an access key for the new BlackBerry Dynamics app. The 
request includes a randomly generated nonce. 
4. One of the following events occurs: 


* The BlackBerry UEM Client sends the access key request and the randomly generated nonce to 
the BlackBerry UEM Core. 

+ If the BlackBerry UEM Client is not installed on the device, or if the device uses Samsung KNOX 
Workspace and this is the first BlackBerry Dynamics app activated, the administrator generates an access 
key to send to the user or the user logs into BlackBerry UEM Self-Service and generates an access key. 

+ If the device or KNOX Workspace already contains an activated BlackBerry Dynamics app, the activated app 
sends an access key request and the randomly generated nonce to the BlackBerry UEM Core. 

5. The BlackBerry UEM Core sends the requested access key to the BlackBerry UEM Client. 
. The BlackBerry UEM Client provides the access key to the BlackBerry Dynamics app. 
7. The BlackBerry Dynamics app establishes an SSL connection with the BlackBerry Dynamics NOC and sends it 

a hash of the access key. 

8. The BlackBerry Dynamics NOC verifies the access key and, if the verification is successful, sends provisioning 
data, including the master link key and connection information, to the BlackBerry Dynamics app. 

9. The BlackBerry Dynamics app begins the process of establishing a shared secret with the BlackBerry UEM 
Core by sending a secure channel setup message to the BlackBerry Dynamics NOC over the SSL connection. 


oO 
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The secure channel setup message contains a user identifier (email address), ephemeral ECDH public key, a 
salt value, a token, and a MAC of the message to authenticate the sender and guarantee the integrity of the 
message. 

10.The BlackBerry Dynamics NOC forwards the secure channel setup message to BlackBerry Proxy over an 
HTTPS connection. 

11.BlackBerry Proxy forwards the secure channel setup message to the BlackBerry UEM Core. 

12. The BlackBerry UEM Core responds to the BlackBerry Dynamics app. The response contains a new ephemeral 
ECDH public key and a MAC of the message. 

13.The BlackBerry Dynamics app requests provisioning data from the BlackBerry UEM Core. The request travels 
through the BlackBerry Dynamics NOC and BlackBerry Proxy. 

14.The BlackBerry UEM Core sends encrypted provisioning data, including the master session key, app 
configuration data, and a list of BlackBerry Proxy instances, to the BlackBerry Dynamics app to complete the 
activation. 
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Data flow: Activating a BlackBerry Dynamics app on a Samsung KNOX 
Workspace device when BlackBerry Secure Connect Plus is enabled 


This data flow describes how data travels when a BlackBerry Dynamics app in the work space on a Samsung 
KNOX Workspace device is activated over a BlackBerry Secure Connect Plus connection. 
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1. An administrator assigns one or more BlackBerry Dynamics apps to a user. 

2. The user installs the app on the Samsung KNOX device. 

3. If the device is not a Samsung KNOX Workspace device and the BlackBerry UEM Client is installed on the 
device, the BlackBerry Dynamics app performs the following actions: 


a. Establishes a secure channel with the BlackBerry UEM Client on the device. Data exchanged over the 
secure channel is encrypted using an AES-CBC cipher. 

b. Asks the BlackBerry UEM Client to request an access key for the new BlackBerry Dynamics app. The 
request includes a randomly generated nonce. 

4. The device sends a request through a TLS tunnel, over port 443, to the BlackBerry Infrastructure to 
request a secure tunnel to the work network. The signal is encrypted by default using FIPS-140 
certified Certicom libraries. The signaling tunnel is encrypted end to end. 

5. BlackBerry Secure Connect Plus receives the request from the BlackBerry Infrastructure through port 3101. 

6. The device and BlackBerry Secure Connect Plus negotiate the tunnel parameters and establish a secure tunnel 
for the device through the BlackBerry Infrastructure. The tunnel is authenticated and encrypted end to end with 
DTLS. 

7. The BlackBerry UEM Client sends the access key request and the randomly generated nonce from BlackBerry 
Secure Connect Plus to the BlackBerry UEM Core. 

8. The BlackBerry UEM Core sends the requested access key from BlackBerry Secure Connect Plus to 
the BlackBerry UEM Client. 

9. The BlackBerry UEM Client provides the access key to the BlackBerry Dynamics app. 

10.The BlackBerry Dynamics app establishes a connection using BlackBerry Secure Connect Plus with 
the BlackBerry Dynamics NOC and sends it a hash of the access key. 
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11.The BlackBerry Dynamics NOC verifies the access key and, if the verification is successful, sends provisioning 
data, including the master link key and connection information, using BlackBerry Secure Connect Plus to 
the BlackBerry Dynamics app. 

12.The BlackBerry Dynamics app begins the process of establishing a shared secret with the BlackBerry UEM 
Core by sending a secure channel setup message to the BlackBerry Dynamics NOC using BlackBerry Secure 
Connect Plus. 


The secure channel setup message contains a user identifier (email address), ephemeral ECDH public key, a 
salt value, a token, and a MAC of the message to authenticate the sender and guarantee the integrity of the 
message. 

13.The BlackBerry Dynamics NOC forwards the secure channel setup message to BlackBerry Proxy over an 
HTTPS connection. 

14.BlackBerry Proxy forwards the secure channel setup message to the BlackBerry UEM Core. 

15. The BlackBerry UEM Core responds to the BlackBerry Dynamics app using BlackBerry Secure Connect Plus. 
The response contains a new ephemeral ECDH public key and a MAC of the message. 

16.The BlackBerry Dynamics app requests provisioning data from the BlackBerry UEM Core. The request travels 
through BlackBerry Secure Connect Plus, the BlackBerry Dynamics NOC, and BlackBerry Proxy. 

17.The BlackBerry UEM Core sends encrypted provisioning data, including the master session key, app 
configuration data, and a list of BlackBerry Proxy instances, to the BlackBerry Dynamics app to complete the 
activation. 
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Data flow: Receiving configuration updates on a BlackBerry 10 device 
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1. An action is taken in the management console that triggers a configuration update for the device. For example, 
you update the IT policy or assign a new profile or app to the user account. 

2. Updates are applied in BlackBerry UEM, and objects that must be shared with the device are identified. 

3. The BlackBerry UEM Core notifies the BlackBerry Infrastructure that there is an update for a device. The 
notification passes through the BlackBerry Router or TCP proxy server, if installed, and the external firewall, 
over port 3101. 

4. The BlackBerry Infrastructure notifies the Enterprise Management Agent on the device that there is an update. 

5. The Enterprise Management Agent on the device polls the BlackBerry UEM Core to request any pending 
actions and commands that must be performed on the device. This poll passes through the BlackBerry 
Infrastructure and the BlackBerry Router, if installed, to the BlackBerry UEM Core. 

6. The BlackBerry UEM Core replies, through the BlackBerry Infrastructure and BlackBerry Router or TCP proxy 
server, if installed, with the highest priority action. 


Priority is given to IT administration commands, such as Delete device data and Lock device, followed by 
requests for device information, installed apps, and so on. The BlackBerry UEM Core sends only one command 
at a time. If necessary, additional information is included in the response. 

7. The Enterprise Management Agent on the device receives the configuration updates and applies the new or 
updated configuration on the device. The Enterprise Management Agent sends a response to the BlackBerry 
UEM Core, through the BlackBerry Infrastructure, to update the command status. The status indicates whether 
the command ran successfully and provides an error message in the event of a failure. 

8. If more actions or commands are pending for the device, the BlackBerry UEM Core replies, through 
the BlackBerry Infrastructure, with the highest priority action. If no actions or commands are pending for the 
device, the BlackBerry UEM Core replies with an idle command. 


Steps 6 to 8 are repeated until no more pending actions or commands must be performed on the device. 
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Data flow: Receiving configuration updates on an Android device 
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1. An action is taken in the management console that triggers a configuration update for an Android device. 

2. Updates are applied in BlackBerry UEM, and objects that must be shared with the device are identified. 

3. The BlackBerry UEM Core contacts the BlackBerry Infrastructure, through the BlackBerry Router or TCP proxy 
server, if installed, and the external firewall over port 3101. 

4. The BlackBerry Infrastructure uses the FCM to notify Android devices that an update is pending. 

5. The GCM sends a notification to the BlackBerry UEM Client on the Android device to contact the BlackBerry 
UEM Core. 

6. The BlackBerry UEM Client contacts the BlackBerry UEM Core, on port 3101 on the external firewall, to request 
any pending actions and commands that must be performed on the device. 

7. The BlackBerry UEM Core replies, through the BlackBerry Infrastructure and BlackBerry Router or TCP proxy 
server, if installed, with the highest priority action. 


Priority is given to IT administration commands, such as Delete device data and Lock device, followed by 
requests for device information, installed apps, and so on. The BlackBerry UEM Core sends only one command 
at a time. If necessary, additional information is included in the response. 

8. The BlackBerry UEM Client inspects the response, schedules the command to be processed, and waits for 
the command to be run. The BlackBerry UEM Client sends a response to the BlackBerry UEM Core, through 
the BlackBerry Infrastructure, to update the command status. The status indicates whether the command ran 
successfully and provides an error message in the event of a failure. 

9. If more actions or commands are pending for the device, the BlackBerry UEM Core replies, through 
the BlackBerry Infrastructure, with the highest priority action. If no actions or commands are pending for the 
device, the BlackBerry UEM Core replies with an idle command. 


Steps 7 to 9 are repeated until no more pending actions or commands must be performed on the device. 


| Receiving device configuration updates | 60 


Data flow: Receiving configuration updates on an iOS device 
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1. An action is taken in the management console that triggers a configuration update for an iOS device. For 
example, you update the IT policy or assign a new profile or app to the user account. 

2. Updates are applied in BlackBerry UEM and objects that must be shared with the device are identified. 

3. The BlackBerry UEM Core performs the following actions: 


a. Contacts the BlackBerry Infrastructure, through the BlackBerry Router or TCP proxy server, if installed, and 
the external firewall over port 3101. 


b. Sends a request through the BlackBerry Infrastructure to the APNs to notify the device that an update is 
pending. 
4. The APNs sends a notification to the native MDM Daemon on the iOS device to contact the BlackBerry UEM 
Core. 


5. When the native MDM Daemon on the iOS device receives the notification, it contacts the BlackBerry UEM 
Core, on port 3101 on the external firewall, passing through the BlackBerry Router or TCP proxy server, if 
installed, to retrieve any pending actions. 

6. The BlackBerry UEM Core replies with the highest priority action. Priority is given to device actions, such 
as Delete device data and Lock device. The BlackBerry UEM Core sends only one command at a time. If 
necessary, additional information is included in the response. If no actions or commands are pending for the 
device, the BlackBerry UEM Core replies to the device with an idle command. 

7. The native MDM Daemon on the iOS device performs the following actions: 


a. Inspects the response from the BlackBerry UEM Core, schedules the command to be processed, and waits 
for the command to run. 


b. Sends aresponse to the BlackBerry UEM Core to update the command status. The status indicates whether 
the command ran successfully and provides an error message in the event of a failure. 


Steps 6 and 7 are repeated until no more pending actions or commands must be performed on the device. 
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Data flow: Receiving configuration updates on a macOS device 
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1. An action is taken in the management console that triggers a configuration update for a macOS device. For 
example, you update the IT policy or assign a new profile or app to the user account. 

2. Updates are applied in BlackBerry UEM, and objects that must be shared with the device are identified. 

3. The BlackBerry UEM Core performs the following actions: 


a. Contacts the BlackBerry Infrastructure, through the BlackBerry Router or TCP proxy server, if installed, and 
the external firewall over port 3101. 
b. Sends a request through the BlackBerry Infrastructure to the APNs to notify the device that an update is 
pending. 
4. The APNs sends a notification to the device to contact the BlackBerry UEM Core. 
5. When the device receives the notification, it contacts the BlackBerry UEM Core, on port 3101 on the external 
firewall, passing through the BlackBerry Router or TCP proxy server, if installed, to retrieve any pending actions. 
6. When an update is pending for the device, the BlackBerry UEM Core replies with the highest priority action. 
Priority is given to device actions, such as Delete device data and Lock device. If necessary, additional 
information is included in the response. If no actions or commands are pending for the device, the BlackBerry 
UEM Core replies to the device with an empty message. 
7. The device performs the following actions: 


a. Inspects the response from the BlackBerry UEM Core, schedules the command to be processed, and waits 
for the command to run. 


b. Sends aresponse to the BlackBerry UEM Core to update the command status. The status indicates whether 
the command ran successfully and provides an error message in the event of a failure. 


Steps 6 and 7 are repeated until no more pending actions or commands must be performed on the device. 
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Data flow: Receiving configuration updates on a Windows 10 device 
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1. An action is taken in the management console that triggers a configuration update for a Windows 10 device. 
For example, you update the IT policy or assign a new profile or app to the user account. 

2. Updates are applied in BlackBerry UEM, and objects that must be shared with the device are identified. 

3. The BlackBerry UEM Core contacts the BlackBerry Infrastructure, through the BlackBerry Router or TCP proxy 
server, if installed, and the external firewall over port 3101. 

4. The BlackBerry Infrastructure uses the WNS to notify the device that an update is pending. 

5. The WNS sends a notification to the device to contact the BlackBerry UEM Core. 

6. When the device receives the notification, it contacts the BlackBerry UEM Core, on port 3101 on the external 
firewall, passing through the BlackBerry Router or TCP proxy server, if installed, to retrieve any pending actions. 

7. When an update is pending for the device, the BlackBerry UEM Core replies with the highest priority action. 
Priority is given to device actions, such as Delete device data and Lock device. If necessary, additional 
information is included in the response. If no actions or commands are pending for the device, the BlackBerry 
UEM Core replies to the device with an empty message. 

8. The device inspects the response, schedules the command to be processed, and waits for the command to 
be run. The device sends a response to the BlackBerry UEM Core to update the command status. The status 
indicates whether the command ran successfully and provides an error message in the event of a failure. 


Steps 7 and 8 are repeated until no more actions or commands are pending for the device. 
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Glossary 


AES 
APNs 
BESS 
CA 
CBC 
CSR 


DMZ 


DTLS 
ECDH 
ECMQV 
EMM 
GCM 
HMAC 
HTTP 


HTTPS 


IP 


IT policy 


MAC 
MDM 
MTLS 
NOC 


PKCS 


Advanced Encryption Standard 

Apple Push Notification service 

BlackBerry Enterprise Server 5 

certification authority 

cipher block chaining 

certificate signing request 

A demilitarized zone (DMZ) is a neutral subnetwork 
outside of an organization's firewall. It exists between 
the trusted LAN of the organization and the untrusted 
external wireless network and public Internet. 
Datagram Transport Layer Security 

Elliptic Curve Diffie-Hellman 

Elliptic Curve Menezes-Qu-Vanstone 

Enterprise Mobility Management 

Google Cloud Messaging 

keyed-hash message authentication code 


Hypertext Transfer Protocol 


Hypertext Transfer Protocol over Secure Sockets 
Layer 


Internet Protocol 


An IT policy consists of various rules that control the 
security features and behavior of devices. 


message authentication code 
mobile device management 
Mutual Transport Layer Security 
Network Operations Center 


Public-Key Cryptography Standards 
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SMTP 
SRP 
SSL 
TCP 


TCP/IP 


TLS 
UDP 
UEM 


BlackBerry UEM domain 


BlackBerry UEM instance 


VPN 


WNS 


Simple Mail Transfer Protocol 

Server Routing Protocol 

Secure Sockets Layer 

Transmission Control Protocol 

Transmission Control Protocol/Internet Protocol 
(TCP/IP) is a set of communication protocols that 

is used to transmit data over networks, such as the 
Internet. 

Transport Layer Security 

User Datagram Protocol 

Unified Endpoint Manager 

A BlackBerry UEM domain consists of a BlackBerry 
UEM database and a BlackBerry Control database and 
any BlackBerry UEM instances that connect to them. 
A BlackBerry UEM instance refers to one installation 
of the BlackBerry UEM Core and all associated 
BlackBerry UEM components that communicate with 
it. The components can be installed on the same 
server or multiple servers. There can be more than 
one BlackBerry UEM instance in a BlackBerry UEM 
domain. 


virtual private network 


Windows Push Notification Services 


| Glossary | 65 


Legal notice 


©2018 BlackBerry Limited. Trademarks, including but not limited to BLACKBERRY, BBM, BES, EMBLEM Design, 
ATHOC, MOVIRTU and SECUSMART are the trademarks or registered trademarks of BlackBerry Limited, its 
subsidiaries and/or affiliates, used under license, and the exclusive rights to such trademarks are expressly 
reserved. All other trademarks are the property of their respective owners. 


Apple and macOS are trademarks of Apple Inc. Google, Android, and Google Apps are trademarks of Google 

Inc. iOS is a trademark of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. i0S® is 
used under license by Apple Inc. Box is including without limitation, either a trademark, service mark or registered 
trademark of Box, Inc. KNOX and Samsung KNOX are trademarks of Samsung Electronics Co., Ltd. Microsoft, 
Active Directory, ActiveSync, Lync, SharePoint, Windows, and Windows Phone are either registered trademarks or 
trademarks of Microsoft Corporation in the United States and/or other countries. Wi-Fi is a trademark of the Wi-Fi 
Alliance. All other trademarks are the property of their respective owners. 


This documentation including all documentation incorporated by reference herein such as documentation 
provided or made available on the BlackBerry website provided or made accessible "AS IS" and "AS AVAILABLE" 
and without condition, endorsement, guarantee, representation, or warranty of any kind by BlackBerry Limited and 
its affiliated companies ("BlackBerry") and BlackBerry assumes no responsibility for any typographical, technical, 
or other inaccuracies, errors, or omissions in this documentation. In order to protect BlackBerry proprietary and 
confidential information and/or trade secrets, this documentation may describe some aspects of BlackBerry 
technology in generalized terms. BlackBerry reserves the right to periodically change information that is contained 
in this documentation; however, BlackBerry makes no commitment to provide any such changes, updates, 
enhancements, or other additions to this documentation to you in a timely manner or at all. 


This documentation might contain references to third-party sources of information, hardware or software, 
products or services including components and content such as content protected by copyright and/or third- 
party websites (collectively the "Third Party Products and Services"). BlackBerry does not control, and is not 
responsible for, any Third Party Products and Services including, without limitation the content, accuracy, 
copyright compliance, compatibility, performance, trustworthiness, legality, decency, links, or any other aspect 
of Third Party Products and Services. The inclusion of a reference to Third Party Products and Services in this 
documentation does not imply endorsement by BlackBerry of the Third Party Products and Services or the third 
party in any way. 


EXCEPT TO THE EXTENT SPECIFICALLY PROHIBITED BY APPLICABLE LAW IN YOUR JURISDICTION, ALL 
CONDITIONS, ENDORSEMENTS, GUARANTEES, REPRESENTATIONS, OR WARRANTIES OF ANY KIND, EXPRESS 
OR IMPLIED, INCLUDING WITHOUT LIMITATION, ANY CONDITIONS, ENDORSEMENTS, GUARANTEES, 
REPRESENTATIONS OR WARRANTIES OF DURABILITY, FITNESS FOR A PARTICULAR PURPOSE OR USE, 
MERCHANTABILITY, MERCHANTABLE QUALITY, NON-INFRINGEMENT, SATISFACTORY QUALITY, OR TITLE, OR 
ARISING FROM A STATUTE OR CUSTOM OR A COURSE OF DEALING OR USAGE OF TRADE, OR RELATED TO THE 
DOCUMENTATION ORITS USE, OR PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, 
SERVICE, OR ANY THIRD PARTY PRODUCTS AND SERVICES REFERENCED HEREIN, ARE HEREBY EXCLUDED. 
YOU MAY ALSO HAVE OTHER RIGHTS THAT VARY BY STATE OR PROVINCE. SOME JURISDICTIONS MAY 

NOT ALLOW THE EXCLUSION OR LIMITATION OF IMPLIED WARRANTIES AND CONDITIONS. TO THE EXTENT 
PERMITTED BY LAW, ANY IMPLIED WARRANTIES OR CONDITIONS RELATING TO THE DOCUMENTATION TO 
THE EXTENT THEY CANNOT BE EXCLUDED AS SET OUT ABOVE, BUT CAN BE LIMITED, ARE HEREBY LIMITED TO 
NINETY (90) DAYS FROM THE DATE YOU FIRST ACQUIRED THE DOCUMENTATION OR THE ITEM THAT IS THE 
SUBJECT OF THE CLAIM. 


TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, IN NO EVENT SHALL 
BLACKBERRY BE LIABLE FOR ANY TYPE OF DAMAGES RELATED TO THIS DOCUMENTATION ORITS USE, 

OR PERFORMANCE OR NON-PERFORMANCE OF ANY SOFTWARE, HARDWARE, SERVICE, OR ANY THIRD 
PARTY PRODUCTS AND SERVICES REFERENCED HEREIN INCLUDING WITHOUT LIMITATION ANY OF THE 
FOLLOWING DAMAGES: DIRECT, CONSEQUENTIAL, EXEMPLARY, INCIDENTAL, INDIRECT, SPECIAL, PUNITIVE, 
OR AGGRAVATED DAMAGES, DAMAGES FOR LOSS OF PROFITS OR REVENUES, FAILURE TO REALIZE ANY 


| Legal notice | 66 


EXPECTED SAVINGS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION, LOSS OF BUSINESS 
OPPORTUNITY, OR CORRUPTION OR LOSS OF DATA, FAILURES TO TRANSMIT OR RECEIVE ANY DATA, 
PROBLEMS ASSOCIATED WITH ANY APPLICATIONS USED IN CONJUNCTION WITH BLACKBERRY PRODUCTS OR 
SERVICES, DOWNTIME COSTS, LOSS OF THE USE OF BLACKBERRY PRODUCTS OR SERVICES OR ANY PORTION 
THEREOF OR OF ANY AIRTIME SERVICES, COST OF SUBSTITUTE GOODS, COSTS OF COVER, FACILITIES OR 
SERVICES, COST OF CAPITAL, OR OTHER SIMILAR PECUNIARY LOSSES, WHETHER OR NOT SUCH DAMAGES 
WERE FORESEEN OR UNFORESEEN, AND EVEN IF BLACKBERRY HAS BEEN ADVISED OF THE POSSIBILITY OF 
SUCH DAMAGES. 


TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW IN YOUR JURISDICTION, BLACKBERRY SHALL 
HAVE NO OTHER OBLIGATION, DUTY, OR LIABILITY WHATSOEVER IN CONTRACT, TORT, OR OTHERWISE TO 
YOU INCLUDING ANY LIABILITY FOR NEGLIGENCE OR STRICT LIABILITY. 


THE LIMITATIONS, EXCLUSIONS, AND DISCLAIMERS HEREIN SHALL APPLY: (A) IRRESPECTIVE OF THE NATURE 
OF THE CAUSE OF ACTION, DEMAND, OR ACTION BY YOU INCLUDING BUT NOT LIMITED TO BREACH OF 
CONTRACT, NEGLIGENCE, TORT, STRICT LIABILITY OR ANY OTHER LEGAL THEORY AND SHALL SURVIVE A 
FUNDAMENTAL BREACH OR BREACHES OR THE FAILURE OF THE ESSENTIAL PURPOSE OF THIS AGREEMENT 
OR OF ANY REMEDY CONTAINED HEREIN; AND (B) TO BLACKBERRY AND ITS AFFILIATED COMPANIES, THEIR 
SUCCESSORS, ASSIGNS, AGENTS, SUPPLIERS (INCLUDING AIRTIME SERVICE PROVIDERS), AUTHORIZED 
BLACKBERRY DISTRIBUTORS (ALSO INCLUDING AIRTIME SERVICE PROVIDERS) AND THEIR RESPECTIVE 
DIRECTORS, EMPLOYEES, AND INDEPENDENT CONTRACTORS. 


IN ADDITION TO THE LIMITATIONS AND EXCLUSIONS SET OUT ABOVE, IN NO EVENT SHALL ANY DIRECTOR, 
EMPLOYEE, AGENT, DISTRIBUTOR, SUPPLIER, INDEPENDENT CONTRACTOR OF BLACKBERRY OR ANY 
AFFILIATES OF BLACKBERRY HAVE ANY LIABILITY ARISING FROM OR RELATED TO THE DOCUMENTATION. 


Prior to subscribing for, installing, or using any Third Party Products and Services, it is your responsibility to 
ensure that your airtime service provider has agreed to support all of their features. Some airtime service 
providers might not offer Internet browsing functionality with a subscription to the BlackBerry® Internet Service. 
Check with your service provider for availability, roaming arrangements, service plans and features. Installation 
or use of Third Party Products and Services with BlackBerry's products and services may require one or more 
patent, trademark, copyright, or other licenses in order to avoid infringement or violation of third party rights. You 
are solely responsible for determining whether to use Third Party Products and Services and if any third party 
licenses are required to do so. If required you are responsible for acquiring them. You should not install or use 
Third Party Products and Services until all necessary licenses have been acquired. Any Third Party Products and 
Services that are provided with BlackBerry's products and services are provided as a convenience to you and are 
provided "AS IS" with no express or implied conditions, endorsements, guarantees, representations, or warranties 
of any kind by BlackBerry and BlackBerry assumes no liability whatsoever, in relation thereto. Your use of Third 
Party Products and Services shall be governed by and subject to you agreeing to the terms of separate licenses 
and other agreements applicable thereto with third parties, except to the extent expressly covered by a license or 
other agreement with BlackBerry. 


The terms of use of any BlackBerry product or service are set out in a separate license or other agreement with 
BlackBerry applicable thereto. NOTHING IN THIS DOCUMENTATION IS INTENDED TO SUPERSEDE ANY EXPRESS 
WRITTEN AGREEMENTS OR WARRANTIES PROVIDED BY BLACKBERRY FOR PORTIONS OF ANY BLACKBERRY 
PRODUCT OR SERVICE OTHER THAN THIS DOCUMENTATION. 


BlackBerry Enterprise Software incorporates certain third-party software. The license and copyright information 
associated with this software is available at http://worldwide.blackberry.com/legal/thirdpartysoftware.jsp. 


BlackBerry Limited 

2200 University Avenue East 
Waterloo, Ontario 

Canada N2K 0A7 


BlackBerry UK Limited 


| Legal notice | 67 


200 Bath Road 
Slough, Berkshire SL1 3XE 
United Kingdom 


Published in Canada 


| Legal notice | 68 


